Who Decides What Is “Personal Data”? The Access Principle in Hong Kong
On Wednesday, 25 October 2017, Lokman Tsui visited the United Nations University Institute on Computing and Society (UNU-CS) and presented his research on access to personal data held by ISPs and mobile operators in Hong Kong. Lokman is an Assistant Professor at the School of Journalism and Communication of the Chinese University of Hong Kong – where he researches free expression and internet policy. He is also a Faculty Associate with the Berkman Center for Internet & Society at Harvard University. Before joining the academia, he was Google’s Head of Free Expression in Asia and the Pacific.
The talk entitled “Who decides what is ‘personal data’?” explored whether the personal data protection laws in Hong Kong, specifically the Personal Data Privacy Ordinance (PDPO), allow citizens to feel reasonably assured that their personal data is protected. Focusing on the access principle (one of six principles that define protected data), Lokman described a study that tested the extent to which the PDPO is enforceable with respect to usage data in the hands of telecommunication companies and internet providers in Hong Kong. Part of the study consisted of submitting data access requests to telecommunication companies and internet providers for a range of information, including subscriber information, IP addresses, geolocation data and whether they had shared any of this data with third parties. Lokman presented the findings of this study and discussed its implications for a future characterized by the Internet of Things and increasing blurriness of the lines between personal and non-personal data.