China's new data export rules cast doubt over Hong Kong's role as gateway to the mainland
South China Morning Post
5 min read
China's new rules governing how data can be sent outside the country could erode Hong Kong's role as a gateway for international businesses to enter the mainland market, experts said.
Starting from September, China will require companies that meet certain criteria to pass a security assessment by the Cyberspace Administration of China (CAC) before transferring data outside the border, according to new regulations finalised earlier this month.
The process will apply to a broad range of companies, including those that handle the personal information of more than 1 million Chinese citizens, and those that seek to transfer "important data" - a term that has not been properly defined.
Do you have questions about the biggest topics and trends from around the world? Get the answers with SCMP Knowledge, our new platform of curated content with explainers, FAQs, analyses and infographics brought to you by our award-winning team.
An entity will also need to undergo an assessment by the CAC if it has been handling the "sensitive" personal data of more than 10,000 people since the beginning of the previous year, or if it has handled the personal information of more than 100,000 Chinese citizens.
While the new rules do not specifically mention Hong Kong or Macau, in practice, the two special administrative regions - governed under the "one country, two systems" principle - are often treated as areas outside the Chinese border, meaning that data transfer from the mainland to Hong Kong could potentially come under scrutiny.
"The regulations cast doubt on Hong Kong's status as a gateway to [mainland] China since they apply equally to any transfer of data outside of mainland China, with no exception for transfers to Hong Kong or Macau," said Gabriela Kennedy, a partner at law firm Mayer Brown in Hong Kong.
"All transfers of data outside of mainland China will be assessed on the merits of the individual circumstances, with no clear advantage for a company in Hong Kong over a company with a comparable data protection regime, like, say, Singapore," she added.
For many international businesses using Hong Kong as a hub for Asia and a gateway to the mainland, the new measures mean that storing data in Hong Kong may become more troublesome than keeping the data on the mainland, said Alex Roberts, counsel for technology, media and telecommunications at Linklaters law firm in Shanghai.
"Bigger, data-rich businesses' data flows to Hong Kong could be blocked under the new rules if the Chinese authorities see a national security risk," Roberts said.
Amid Beijing's plans for closer integration of cities in the Greater Bay Area (GBA) - an economic zone in southern China consisting of Hong Kong, Macau and the mainland province of Guangdong - Hong Kong's government has been pushing for the city to become a major data hub, touting its advantages including reliable infrastructure, freedom of information and easier access to the mainland market.
The new rules, however, do not seem to confer Hong Kong any special status, posing a roadblock to the free flow of data within the GBA.
"Given the close connection between Hong Kong and mainland China, it is envisioned that many companies who have offices in both locations would be affected by the measures, especially if the Hong Kong office is the headquarters and manages all employee records, including those in the mainland China offices," said Charles To, a partner at law firm Ellalan in Hong Kong.
Buildings in Shenzhen seen behind residential buildings in Hong Kong. Photo: Bloomberg alt=Buildings in Shenzhen seen behind residential buildings in Hong Kong. Photo: Bloomberg>
Hong Kong has traditionally been a leader in data protection, having put in place a data law in 1996. But the Personal Data (Privacy) Ordinance has barely been updated since it came into force and is now considered to be outdated and inferior to the increasingly comprehensive data regime on the mainland. An article that is designed to add scrutiny on cross-border data flows between Hong Kong and other jurisdictions has yet to take effect.
While the latest measures offered clarifications about details of the CAC's security assessment, they do not significantly change what was already announced previously, said Peter Bullock, a partner at King & Wood Mallesons law firm in Hong Kong.
"There is little, if anything, here to give Hong Kong a VIP lane for transfer of personal and other data out of China," he said. "The challenge remains for those in the Greater Bay Area to find ways to promote and enable cross border transfers."
Still, some say there are ways that Hong Kong could benefit from the situation.
Ellalan's To said that multinational corporations with international operations may prefer Hong Kong compared to mainland cities such as Shenzhen or Guangzhou, as there is no restriction on data transfers from Hong Kong to overseas.
"International companies that wish to tap into the GBA market or the Chinese market in general may decide to set up in Hong Kong [rather than] other GBA cities," To said.
