Facilitating Cross-boundary Data Flow within the Greater Bay Area
Importance of Cross-boundary Data Flow
Data plays a strategic role in driving innovation and facilitating high-quality development of the economy. The Government of the Hong Kong Special Administrative Region fully recognises the crucial role of data as a new engine in propelling our economic growth and transformation of digital economy and society. The 14th Five Year Plan indicates its solid support for Hong Kong’s development as an international Innovation and Technology (I&T) hub. Facilitating data flow in the Guangdong-Hong Kong-Macao Greater Bay Area (GBA) is an important initiative for promoting high-quality development of the economy. It also contributes to drive digital economy and smart city development, which paves the way for Hong Kong to integrate into the development of the GBA and the nation.
The Memorandum
The close tie between Hong Kong industries and Mainland business partners results in an increasing demand for cross-boundary services and data flow between Hong Kong and the GBA. In view of this, the Innovation, Technology and Industry Bureau (ITIB) and the Cyberspace Administration of China (CAC) signed the “Memorandum of Understanding on Facilitating Cross-boundary Data Flow within the Guangdong-Hong Kong-Macao Greater Bay Area” (the Memorandum) in Beijing on 29 June 2023 to jointly promote cross-boundary data flow within the GBA. It is a policy breakthrough to leverage data flow to promote digital economic development, while at the same time protect personal privacy and data security. The “Standard Contract for the Cross-boundary Flow of Personal Information within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)” (the GBA Standard Contract) arrangement is a facilitation measure under the Memorandum which serves to facilitate the cross-boundary flow of personal information within the GBA.
Facilitation Measures under the Memorandum
The ITIB and the CAC jointly announced on 13 December 2023 the “GBA Standard Contract”
The Provisions on Promoting and Regulating Cross-border Data Flow (the Provisions)
The CAC announced the “Provisions on Promoting and Regulating Cross-Border Data Flow” (the Provisions) (Chinese only) on 22 March 2024 and the Provisions became effective on the same day.
“The Provisions mainly stipulates the following contents: 1) it clarifies the reporting standards for security assessments for the outbound flow of important data; 2) it specifies the conditions for outbound data flow activities that are exempt from reporting security assessments for the outbound flow of data, signing standard contracts for the outbound flow of personal information, and passing personal information protection certifications; 3) it establishes a negative list for pilot Free Trade Zones; 4) it adjusts the conditions for outbound data flow activities that require declaring security assessments for the outbound flow of data, signing standard contracts for the outbound flow of personal information, and passing personal information protection certifications; and 5) it extends the validity period of the results of outbound data flow security assessments, and adds a provision that data processors can apply to extend the validity period of the assessment results.” (Translation of the excerpt from the “Response to Reporters’ Questions on the Provisions on Promoting and Regulating Cross-border Data Flow by the Cyberspace Administration of Guangdong Province” (Chinese Only))
The Provisions introduces specific circumstances under which the standard contracts for the outbound flow of personal information may be exempt from being concluded and personal information protection certification may be passed, which are also applicable to cross-boundary data flow between the Mainland cities in the GBA and Hong Kong. According to the Provisions, data processors shall identify and declare important data in accordance with the relevant provisions. If the data concerned has not been notified or publicly released as important data by the relevant authorities or regions, the data processor is not required to report it as important data for the outbound data flow security assessment.
