Data Protection and Privacy

Data Protection and Privacy Experience

• Successfully represented Google in an appeal against the Hong Kong Privacy Commissioner resulting in a landmark decision where the Administrative Appeals Board confirmed the jurisdictional application of Hong Kong privacy law, and that there is no independent “Right to be Forgotten” under Hong Kong law.

• Advised a leading Chinese multinational technology company specialising in e-commerce, internet and technology on Hong Kong data privacy and consumer protection issues relating to the sale and advertising of consumer products on e-commerce platforms including reviewing and amending terms of service and privacy policies.

• Advised a Hong Kong independent non-profit organisation on personal data collection statement, privacy statement, online terms and conditions of service, model online dispute resolution agreement, and internal staff policy/manual for data protection for compliance with Hong Kong data privacy laws.

• Advised a global business consultancy company on the provision of cybersecurity services including penetration testing, incident response, cyber investigations and computer forensics, threat and vulnerability assessment, social engineering and security exercises.

• Advised a leading online event registration platform on a global data breach incident resulting from malicious code sent by unauthorised third parties including handling the breach notification to the Privacy Commissioner, coordinating on the global breach reporting, advising on privilege issues arising from the disclosure of documents and successfully avoiding an enforcement notice.

• Advised a Japanese multinational consumer electronics and video game company on data privacy and issues regarding direct marketing, target marketing and behavioural tracking relating to its consumer products, customer accounts, and customer loyalty programme, the privacy implications of an in-game virtual currency management system, smart device applications and user generated contents, including the rights of minors.

• Advised an aviation company on data privacy and regulatory issues in relation to direct marketing to individuals and businesses by email, SMS and cold calls.

• Advised a well-known international electronics brand on an investigation by the Privacy Commissioner in relation to the collection of HKID card numbers and successfully appealed the Privacy Commissioner’s decision.

• Advised a well-known social networking platform on its privacy policy including in relation to the use of cookies, the processing and transfer of personal data, the use of data processors and out-sourcing, the rights of data subjects and the personal data of minors, notice requirements and organisational training requirements.

• Advised a Hong Kong-listed conglomerate on the compliance requirements to facilitate the cross-border transfer of personal data from Mainland China to Hong Kong, including preparing template data transfer contracts and data protection clauses in employees’ contract and assisting with self-security assessment.

• Advised a world leading sports footwear manufacturer on legal requirements and practices in relation to online trade, consumer protection and data privacy protection in China in relation to setting up online B2C sales platform in including preparing the terms and conditions and privacy policy for use of the platform.

• Advised a world leading cosmetic and personal care corporation on localising its global privacy policy and website terms and conditions to comply with Mainland Chinese law in preparation for the launch of its new e-commerce platform.

• Advised a Singapore-based logistics group on the applicable legal framework for the protection of personal data, important data, confidential information, trade secrets and state secrets in Mainland China.