ABLI-FPF Convergences Series - Status of Consent for Processing Personal Data (Hong Kong SAR report)

• notice and consent requirements for processing personal data;
• alternative legal bases for processing personal data which permit processing of personal data without consent if the data controller undertakes a risk impact assessment (e.g., legitimate interests); and
• statutory bases for processing personal data without consent and exceptions or derogations from consent requirements in laws and regulations.

1. INTRODUCTION 

2. CONSENT AND PRIVACY SELF-MANAGEMENT IN THE PDPO

3. ROLE OF THE PRIVACY COMMISSIONER FOR PERSONAL DATA (“PCPD”) 

4. CONDITIONS FOR CONSENT

    4.1. Definition and forms of consent

    4.2. "Prescribed" consent

    4.3. Withdrawal of consent

    4.4. Bundled consent

5. CONSENT FOR SPECIAL CATEGORIES OR USES OF DATA

    5.1. Children

    5.2. Direct marketing 

6. CONSENT FOR CROSS-BORDER DATA TRANSFERS 

7. TRANSPARENCY AND NOTICE   

8. SANCTIONS AND ENFORCEMENT

    8.1. Disclosing personal data without consent

    8.2. Using or disclosing personal data for direct marketing purposes without consent

9. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT SUBJECT TO A RISK IMPACT ASSESSMENT

10. COLLECTING, USING, AND DISCLOSING DATA WITHOUT CONSENT IN OTHER CIRCUMSTANCES DEFINED BY LAW

       10.1. Health exception (PDPO, s 59) in the context of COVID-19