Law_World_434_sg_01

HarborView requires all customer documents to be sent to their offices in the Cayman Islands headquarters, including information of Hong Kong customers. We’ve also already sent them documents as part of our due diligence – please see the transaction/deal documents on file.

Can you please draft a brief memo (just a few paragraphs) explaining whether consent is required to transfer the customer’s data and, if so, whether SecureBox or HarborView is obligated to erase any or all transferred records...

RE: Data Privacy and SecureBox Customer Information

The central question of this memorandum is whether consent is required to transfer information that SecureBox obtained from Hong Kong customers to HarborView’s offices in the Cayman Islands and, if so, whether SecureBox or HarborView is obligated to erase any or all transferred records. This memorandum also analyzes whether a data transfer agreement is required under the laws of Hong Kong or the Cayman Islands. The data submitted to HarborView regarding the personal information of Hong Kong customers is largely governed by the “Personal Data (Privacy) Ordinance" (PDPO). 

## 1. Is customer consent required to transfer the information to HarborView?
Customer’s consent is likely not required for the personal information of Hong Kong customers that is sent for the purpose of due diligence, i.e. in connection with facilitating the deal, between SecureBox and HarborView. This is based on the exemptions listed under the PDPO’s data protection principle 3 (See Page 7 of “Data Protection.pdf”: “In addition, the Ordinance contains exemptions to the restrictions on use and disclosure of personal data under data protection principle 3 (see Section IV.A.2). Exemptions apply for any use or disclosure of personal data which is… For the purpose of a due diligence exercise in connection with a proposed share sale, asset sale or merger.”).

However, any customer information that is sent after the deal for the purpose of the regular business operations of HarborView is likely to require fresh consent. Based on the documents in file, it appears that SecureBox likely obtained customer’s information for its regular business purpose in compliance with the relevant privacy laws of all jurisdictions including the PDPO (for e.g. see “notice_of_transfer_of_interests.pdf” which is a standard form that includes the following statement: “Under the Personal Data (Privacy) Ordinance, you have the right to access and correct the personal data that you have submitted. If you wish to access and correct your personal data, your request can be made to the Fire Safety Section of the Buildings Department via above means.”; see also “Financing Docs Combined V.4.docx” at page 57 which lists as an excluded asset: "Personal data unrelated to the business" which compliles with Cayman Islands laws and PDPO). However, sending the information to a different entity does not appear in any documents and it is unlikely to have been part of the purposes that formed the basis of the customers’ initial consent. Though it can be argued that if HarborView is using the data for the same purpose as it was initially collected, then it may be a “directly related purpose” which is also an exemption under the PDPO’s data protection principle 3, the safer assumption is that HarborView should obtain consent from the customers given the lack of our ability to review the actual consents recorded.

## 2. Is SecureBox or HarborView required to erase any transferred records?
Yes, HarborView is likely required to destroy any records of the personal information of Hong Kong customers it received. Section 26 of the PDPO mandates the erasure of personal data when it is no longer needed for the original purpose (consistent with the PDPO’s data protection principle 2 in “Data Protection.pdf” at page 9: “It provides that personal data must be accurate, up-to-date and not be retained any longer than necessary.”). 

This applies to the customer information that was likely obtained for a new purpose as well as the information that was sent for the purpose of due diligence, i.e. in connection with facilitating the deal, between SecureBox and HarborView. HarborView further appears to have a contractual obligation to destroy the information received for the purpose of the due diligence (see “Financing Docs Combined V.4.docx” at page 81: “Seller must keep…customer data…confidential and must destroy all copies.”).

## 3. Data Transfer Agreement
For the jurisdiction of Hong Kong, there is no data transfer agreement required at all (See “Data Protection.pdf” at page 17: “Data transfer agreements are not required because the Personal Data (Privacy) Ordinance (Cap. 486) (Ordinance) does not currently restrict the transfer of personal data outside of Hong Kong (see Section VII.A.1). If section 33 of the Ordinance were to be enacted, a well-drafted data transfer agreement would be sufficient to legitimise the transfer of personal data outside of Hong Kong. However, there would also be a number of other options available, including obtaining consent from the data subject.”). 

For the jurisdiction of the Cayman Islands, there is also no data transfer agreement required. Assuming that HarborView will obtain the necessary consents and delete any data for which there is no valid consent, any data that is transferred will be with consent or for due diligence. As such, any data transferred will not require a data transfer agreement under Cayman Islands law (See “Cayman Island Data Privacy Laws..pdf” at page 78: “No DTA required if transfer is: made with the individual’s consent; necessary for the performance of a contract between the individual and the organisation, or for pre-contractual steps taken at the individual’s request; necessary for the performance of a contract made in the interests of the individual between the controller and another person;”).