Cross-border transfer restrictions and obligations imposed by China’s Personal Information Protection Law (PIPL) and its supporting regulations may soon cause Hong Kong to prohibit the export of personal information received from mainland China. Institutions will need to carefully examine their
Chinese international research and academic operations to determine whether they rely upon personal information flowing through Hong Kong from mainland China and will need to formulate contingency plans to avoid operational disruptions in the event that they can no longer transfer personal information from Hong Kong to the U.S. when the information originates from mainland China.
PIPL, coupled with the 2021 Measures for Data Export Security Assessments, provide very few practicable mechanisms for institutions to legally transfer personal information from mainland China to the U.S. or other countries. For institutions that are unwilling to undergo assessment or certification by the Chinese government, which could give rise to a variety of compliance issues under U.S. laws and regulations, currently the only legal way to transfer any personal information from mainland China to the U.S. is to enter into standard contractual clauses, which are currently published only in draft form, with the party transferring the personal information. However, this transfer mechanism is unavailable for certain types of high-risk transfers (e.g., transfers of “important” data; cumulative transfers of over 100,000 people’s personal information or 10,000 people’s sensitive personal information), leaving institutions with no options other than to undergo assessment by the Chinese government to make these types of transfers.
Currently, in accordance with the “one country, two systems” concept, U.S. institutions transferring personal information from Hong Kong to the U.S. are able to complete such transfers without being limited by the cross-border transfer restrictions imposed by PIPL and its supporting regulations. But these transfers may soon end if Hong Kong implements its own laws and regulations to prohibit the export of personal information that originates from mainland China. And Hong Kong appears to be headed in this direction, as Hong Kong officials believe this may be the only way to convince the Chinese government to relax PIPL’s cross-border transfer restrictions, which are currently making it very difficult for Hong Kong companies to conduct business operations involving personal information received from mainland China.
Institutions with Chinese international research or academic operations should closely monitor legal developments in this area and should consider contingency plans in the event that Hong Kong does ultimately prohibit all exports of personal information received from mainland China.