Hong Kong hospitals, banks embrace relaxed data transfer rules

Whilst not mandatory, they could simplify data exchange with cities in South China.

Banks, credit raters, and hospitals are among the first to take advantage of relaxed data transfer rules between Hong Kong and the nine mainland cities in the Greater Bay Area, amidst Chinese efforts to allay foreign business concerns about strict data flows and reverse a decline in foreign investment.

The city’s Digital Policy Office has received expressions of interest from key players in these sectors, Joyce Chan, a partner at London-headquartered law firm Clyde & Co, told Hong Kong Business. But there is no public record showing the companies that have submitted these forms, she pointed out.

Financial institutions stand to benefit from the relaxed data rules, which took effect in December 2023, since they deal with large volumes of personal information, said Dora Si, a partner for the Intellectual Property Department at Deacons, a law firm in Hong Kong.

She said healthcare providers would also gain from the arrangement because it helps patients to “more efficiently and conveniently share personal information, which potentially speeds up diagnosis too.”

Hospitals could also share research and development resources, biomedicine and clinical trial data, while insurance companies could fast-track claims, said Joyce Ma, senior associate at Clyde & Co.

China’s rules on data transfers, introduced in 2021 and empowered President Xi Jinping’s government to shutter or fine companies that leak or mishandle sensitive information, have caused widespread anxiety among foreign companies there.

In March, Beijing loosened the rules by exempting data collected in international trade, cross-border travel, manufacturing, academic research, and marketing that don’t contain “important” information from security checks, as it tries to ease corporate worries and revive faltering growth in the world’s second-largest economy.

These laws have no specific coverage for the Guangdong–Hong Kong–Macao Greater Bay Area (GBA), and a standard contract for transferring personal information within the GBA was jointly issued by Chinese and Hong Kong regulators in December 2023 to fill this gap.

The adoption of the relaxed data rules within the Greater Bay Area is voluntary. Data transfers should exclude important data, which may include personal information depending on relevant agencies or regions. The standard contract also does not cover the transfer of personal information to people or organisations outside the Greater Bay Area.

Chan noted that companies in China must align their data processing practices with stringent requirements on cross-border data transfers, and these apply to cross-border data transfers from Mainland China to Hong Kong.

“The implementation of the GBA standard contract will no doubt be the first step to ease these restrictions and simplify the exchange of data between the mainland cities in the GBA and Hong Kong to facilitate business,” she added.

Chan said financial institutions could quicken loan approvals and bank account openings from clients in the Greater Bay Area because of the relaxed data rules.

Si said cross-border banks and financing institutions would benefit from the more relaxed data rules which potentially smoothen the transfer of credit histories and other personal information as part of their operations.

Financial institutions with Greater Area Bay presence include HSBC and Standard Chartered. Both declined to comment.

Asking the right questions

One advantage of the standard contract is the absence of data volume limits, which differs from the requirements under the mainland’s Personal Information Protection Law (PIPL). Under the current regulatory requirements, exporting sensitive data of 10,000 or more people annually, or the personal data of a million people or more, can trigger a mandatory security check.

“Considering the size of the Greater Bay Area market, the thresholds [set by the Chinese law and regulations] would be triggered easily in the absence of the GBA standard contract,” Si told Hong Kong Business.

Chan said the Greater Bay Area standard contract could lower companies’ compliance costs involving data flows.

James Gong, legal director at Bird & Bird, said companies should evaluate which rules they intend to follow. “They need to ask questions like ‘What’s the purpose of my transfer? Do I need to transfer this data outside the Greater Bay Area? If I don’t, should I consider the possibility that I might need to in the future? If so, how likely is that?’”

“In addition to that, for Hong Kong companies transferring data to Mainland China, the question is whether they need to follow this specific regime, or if it’s sufficient to just transfer the data directly to Mainland China,” he said.

“Generally speaking, current Hong Kong regulations do not impose stringent restrictions on transfers from Hong Kong to Mainland China,” he added.

Si, for her part, noted that whilst companies that don’t transfer as much personal data might not need the GBA standard contract, it is still in their best interest to have their transfer arrangement in writing.