HKSQ applied the Trade and Industry Department (TID)
Funded project named “Feasibility Study
on the Quality of Hong Kong Start-up Development for Supporting the Sustainable
Business Growth” and HKQAA is our implementation agent. In the last stage, we
arranged several workshops to share the study results and guidelines for startup. The third workshops named “Implementation Workshop
for Startups – Data Protection and Privacy” (初創企業實踐工作坊－數據保護和隱私的規範) was held on 6 Jun 2022. I
represented HKSQ to attend the workshop.
Mr. KT Ting (HKQAA) is the speaker for this implementation
workshop on data protection and privacy. His topics included protection of
individual privacy, legal & regulatory requirement and introduced the Office
of the Privacy Commissioner for Personal Data (PCPD).
Firstly, Mr. Ting briefed if your startup needed to
collection, holding, processing or use of personal data directly or indirectly,
you needed to consider the data protection and privacy through 3 key aspects
and they were confidentiality, integrity and availability.
Health data is type of personal data that should be considered
during Covid-19 pandemic.
Recently, PCPD updated the Personal Data (Privacy) Ordinance (PDPO) to
control Doxxing. Then Mr. Ting mentioned six data protection principle (DPP) as
follows.
DPP1 – Purpose and Manner of Collection
DPP2 – Accuracy and Duration of Retention
DPP3 – Use of Data
DPP4 – Data Security
DPP5 – Openness and Transparency
DPP6 – Access and Correction
After that Mr. Ting introduced different guidelines under PCPD including:
-
Code of Practices on Consumer
Credit Data
-
Code of Practices on the
Identity Card Number and Other Personal Identifiers
-
Code of Practices on Human
Resource Management
-
Privacy Guidelines: Monitoring
and Personal Data Privacy at Work
Then he also introduced European Union General Data
Protection Regulation (GDPR).
Finally, privacy risks of fintech were stated and 10 recommended good
practices for Fintech providers / operators were briefed below.
1.
The privacy policies should be
transparent and written in plain and user-friendly languages.
2.
Collect and retain minimum
amount of personal data
3.
Provide clear and genuine
options to consumers with respect to collection and use of personal data
4.
Ensure the accuracy and
impartiality of the personal data
5.
Ensure the reliability and
fairness of Fintech algorithms, and provide consumers with explanations on the
automatic assessments and decisions by the Fintech
6.
Adopt appropriate policies,
procedures and techniques to safeguard personal data
7.
Adopt contractual or other
means (e.g. field audit) to ensure proper protection to personal data by data
processors
8.
Conduct privacy impact
assessment at or before the development stage of Fintech so as to identify and
properly address potential privacy risks
9.
Adopt privacy-friendly design
in Fintech
10. Develop procedures in relation to handling of data breach incidents
