#
Financial-sector overlay is well-evidenced; health, telecoms/ePrivacy, employment, and education sub-modules are thin or unevidenced.
Sub-modules (7)
Financial Sector OverlayAmber
HKMA, Insurance Authority, and SFC issue customer-data circulars/guidelines applicable to licensed institutions, overlaying general PDPO duties.
Claims (2):
- There are no sectoral data privacy laws as such in Hong Kong, but certain industry-specific requirements are imposed by relevant regulators in respect of customer data held by regulated entities.
- The Hong Kong Monetary Authority has issued several circulars and guidelines relating to protection and confidentiality of customer data applicable to all licensed banks under the Banking Ordinance (Cap. 155).
Health Sector OverlayRed
No dedicated health-sector data-privacy statute (e.g., HIPAA-equivalent) was identified in this research pass.
Absence provenance: unavailable. Searched: Hong Kong health data privacy sectoral law, Hong Kong medical data protection statute.
Telecoms And EprivacyRed
No dedicated telecoms/ePrivacy-style cookie-and-communications-specific statute was identified.
Absence provenance: unavailable. Searched: Hong Kong ePrivacy telecoms data law, Hong Kong cookie law telecoms.
Employment DataAmber
Retention limitation rules require employee personal data not be kept beyond the period necessary after termination of employment absent a subsisting reason.
Claims (1):
- Under DPP2(2)/Section 26, employee personal data must not be kept longer than necessary after the end of employment, unless a subsisting reason requires the employer to hold the data longer.
Credit And ScoringAmber
PCPD guidance flags consumer credit data as a category requiring heightened caution in collection and use.
Claims (1):
- The PCPD has published guidelines on the collection and use of consumer credit data, requiring caution and setting practical guidance on proper collection and use.
EducationRed
No dedicated education-sector data-privacy rules were identified in this research pass.
Absence provenance: unavailable. Searched: Hong Kong education sector data privacy rules PCPD.
InsuranceAmber
The Insurance Authority requires authorised insurers to implement cybersecurity frameworks protecting policyholder personal data.
Claims (1):
- The Insurance Authority has issued a Guideline on Cybersecurity requiring authorised insurers to implement robust cybersecurity frameworks to protect the personal data of existing or potential policyholders.
no periodic updates on record for this sub-brief
Sources and claims (5)
- ProbableDataGuidance — There are no sectoral data privacy laws as such in Hong Kong, but certain industry-specific requirements are imposed by relevant regulators in respect of customer data held by regulated entities.observed
- ProbableDataGuidance — The Hong Kong Monetary Authority has issued several circulars and guidelines relating to protection and confidentiality of customer data applicable to all licensed banks under the Banking Ordinance (Cap. 155).observed
- ProbableDataGuidance — Under DPP2(2)/Section 26, employee personal data must not be kept longer than necessary after the end of employment, unless a subsisting reason requires the employer to hold the data longer.observed
- ProbableDataGuidance — The PCPD has published guidelines on the collection and use of consumer credit data, requiring caution and setting practical guidance on proper collection and use.observed
- ProbableDataGuidance — The Insurance Authority has issued a Guideline on Cybersecurity requiring authorised insurers to implement robust cybersecurity frameworks to protect the personal data of existing or potential policyholders.observed