Out-Law News 1 min. read

Data protection compliance not a tick-box exercise, says outgoing Hong Kong privacy commissioner


Businesses should not view data protection compliance as a tick-box exercise, a watchdog in Asia has said.

In a blog to mark the end of his five year tenure as Hong Kong's privacy commissioner, Allan Chiang said senior business executives have a role to play in promoting data privacy in their organisations. He encouraged companies to develop privacy management programmes to improve internal accountability for data privacy.

"The law provides the minimum standards of privacy protection which may not meet the expectation of the consumer," Chiang said. "A more effective response in this era of big data and rising public expectation for privacy protection is to be proactive and preventative, rather than reactive and remedial. Organisations should embrace personal data privacy protection as part of their corporate governance responsibilities and apply it as a top-down business imperative throughout the organisation."

"A strategic shift from compliance to accountability is required. This entails the adoption of holistic and encompassing privacy management programmes that ensure robust privacy policies and procedures are in place and implemented for all business practices, operational processes, as well as product and service design," he said.

Hong Kong-based expert in technology and data protection law Peter Bullock of Pinsent Masons, the law firm behind Out-Law.com, said Chiang's final blog revisited a theme he had promoted in recent months.

"Outgoing privacy commissioner Allan Chiang has for the last 18 months been working under a premise that mere legal compliance with the Personal Data (Privacy) Ordinance is insufficient to ensure adequate privacy procedures within an organisation," Bullock said. "He has been successful in convincing a fairly large number of enterprises to sign up to this contention. This may be good for the privacy effort but it does nothing to provide certainty to organisations seeking compliance. It will be interesting to see whether incoming commissioner Stephen Wong will develop this theme."

In his blog, Chiang also outlined his view that businesses that offer sound privacy protection to consumers can obtain a competitive advantage over rivals.

"Ultimately, customer attitudes and preferences will determine the success or failure of a product or service and the details of its offerings," Chiang said. "Hence technology providers should be committed to building privacy and data protection into their products and services so as to meet the privacy expectations of customers and win their trust and loyalty. It is encouraging to note that some technology giants are indeed adopting privacy protection as a competitive advantage, thus ensuring transparency, fair process and accountability in their business strategies and corporate policies."

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.