TNAG-1613-FCO40-2221-Executive-Council-of-Hong-Kong-memoranda-and-minutes-of-meet-1987 — Page 87

GF 323

CONFIDENTIAL ##

- 7 -

mean a substantial overhead, particularly for the private Third, even if funds were made available for the conversion work to be effected, there may not be sufficient qualified personnel to undertake the programming and conversion work. Fourth, the main computer users who hold large quantities of data on individuals are the Government, the utility companies and the banks. Being responsible organizations, they have a vested interest in ensuring that their data are accurate and are kept as securely and confidentially as possible. It is, therefore, considered that the compulsory compliance approach is not appropriate in the Hong Kong context.

16.

The voluntary compliance approach backed by legislation

This approach, adopted in West Germany and Denmark, is the middle-of-the-road option favoured by the Working Group's Sub-committee. It entails the enactment of legislation to establish a set of data protection principles and an independent agency having a 'watch-dog' function. Although such an agency would have no power to impose formal sanctions, it could investigate complaints under the provisions of the legislation. An advantage of this approach, if applied to Hong Kong, would be that Hong Kong would be seen to have data protection legislation and would then be less likely to fall foul, in respect of trans-border data flow, of any domestic data protection legislation of a state which had ratified the Council of Europe Convention (discussed later in paragraph 20). the other hand, the disadvantage associated with this approach is that the proposed agency might be viewed as a quasi-judicial means to impose restriction on freedom. addition, since the proposed agency would have no sanctioning powers where there had been breaches of the data protection principles, the credibility of Government could be at stake if there were widespread malpractices.

View taken by the Working Group

17.

In

of the various options, the voluntary compliance approach, perhaps with some modifications, is considered to be the most suitable for adoption in Hong Kong. The Working Group has given very careful consideration to the arguments for and against the present need for the enactment of legislation in the adoption of this approach. It is noted that if data protection legislation were enacted, Hong Kong would be seen as keeping pace with other developed countries in the protection of personal information stored in computer systems and the potential threat of Hong Kong being denied access to flow of data from countries which had enacted data protection

CONFIDENTIAL #

機密