The Cyberspace Administration of China (CAC) and the Bureau of Innovation, Technology and Industry in Hong Kong have jointly issued ‘Implementation Guidelines for Standard Contracts for Cross-border Flows of Personal Data’ (the Facilitation Measure).
The Facilitation Measure applies to transfers - in either direction - of personal data between organisations registered in nine cities in Guangdong province and organisations registered in Hong Kong under a simplified form of standard contract (known as the GBA Standard Contract) and without an obligation to file an impact assessment. The GBA Standard Contract itself will still need to be filed (within the usual period of 10 working days), and would need to be separately filed both with the Guangdong CAC and with the Office of the Government Chief Information Officer (OGCIO) in Hong Kong. An impact assessment will also still need to be carried out (within the three-month period before entry into the GBA Standard Contract), even if the impact assessment may potentially not need to be filed.
The arrangement does not extend to Macau, and onward transfers of personal data outside the GBA are not permitted. This transfer route is also not applicable to transfers of ‘important data’.
Use of the GBA Standard Contract in preference to other transfer routes is voluntary. For transfers of personal data from the mainland China region of the GBA into Hong Kong, clarification will be needed as to whether or not the GBA Standard Contract displaces any of the existing thresholds and requirements for cross-border data transfer (the Facilitation Measures do not explicitly state this, but simultaneously leave open the door to this possibility). We have received conflicting views from Guangdong CAC on this point. However, given that the stated aim of the Facilitation Measure is to streamline compliance arrangements in respect of data flows with the GBA, the measure would appear to lack utility if the ordinary requirements were to continue to apply alongside it.
Transfers of personal data from Hong Kong are not expressly regulated under Hong Kong law (although will often involve a processor relationship). As such the Facilitation Measure does not create any explicit new obligations in respect of transfers of personal data from Hong Kong into the GBA. The OGCIO began a pilot scheme on 1 January 2024 and had previously stated that it intended to invite participation from the banking, credit reference and healthcare sectors.
There is further ambiguity on the question of whether personal data collected in other regions of China could be transferred to Hong Kong by an organisation registered in the mainland China region of the GBA. While this would seem unlikely in principle, the FAQs published by the OGCIO appear to indicate that this might in fact be possible in some circumstances.