professional workshops on data protection august to ... for aug - dec 2018_eng.… · who should...
TRANSCRIPT
Supporting Organisations: (in alphabetical order)
Professional Workshops on Data Protection
August to December 2018
Hong Kong
Bar Association
Hong Kong Institute of
Certified Public Accountants
1
Professional Workshops on Data Protection
In Hong Kong, individuals’ awareness and expectation of their rights in relation to
personal data privacy have reached an unprecedented level after recent incidents of
corporate malpractices in the use of personal data.
Data protection has become a vital component to the success of business in building
employee trust and enhancing corporate image. If your business involves the
collection and use of personal data, it is important that your staff are fully up-to-date
and compliant with the requirements under the Personal Data (Privacy) Ordinance
(“the Ordinance”).
The Office of the Privacy Commissioner for Personal Data (“PCPD”) has developed a
series of professional workshops on data protection tailored to the needs of those
dealing with personal data in different work contexts. Participants will work through
guidance notes issued by the PCPD and practical scenarios with expert guidance from
PCPD’s experienced trainers or commissioned consultants.
Upon completion of the workshop, participants will possess a solid knowledge of data
protection law, as well as an understanding of the practical implications of the legal
requirements under the Ordinance. Participants will be encouraged to discuss cases
that they have dealt with and to share ideas and knowledge with other participants.
Questions will be answered within a systematic framework enabling participants to
apply the fundamental principles to a range of privacy issues.
Key features
- Conducted experienced staff from the PCPD
- Fully up-to-date and comprehensive course materials
- Sharing ideas with others
- Interaction with the trainer and other participants
- Case study based on real cases
- PCPD’s updated guidance notes
- Certificate of participation awarded at each course
- Plenty of opportunities for questions
- Bring your queries to the workshop
Who should attend
Data Protection Officers, Human Resource Managers, Administration Managers,
Compliance Officers, Data Security Personnel, Company Secretaries, Marketing
Personnel, Solicitors (in-house or private practice), Insurers, IT Managers, Policy
Advisers
2
Course contents
- Definitions and interpretation of the legal terminology in the Ordinance
- Analysis of each data protection principle with relevant real-life scenarios
- PCPD complaint handling process
- Codes of Practice and Guidelines
- Updated guidance notes from the PCPD
- Lessons learnt from real cases
- Recommended good practices
Methodology
- Lecture
- Case study
- Discussion
- Question and answer
Courses available
- Data Protection in Human Resource Management
- Data Protection and Data Access Request
- Practical Workshop on Data Protection Law
- Data Protection in Banking/Financial Services
- Data Protection in Insurance
- Data Protection in Direct Marketing Activities
- Privacy Management Programme
- Recent Court and Administrative Appeals Board Decisions
In-depth workshops
The Workshops are open to people wishing to deepen their knowledge of data protection.
To acquire basic knowledge of the Personal Data (Privacy) Ordinance, you may:-
i) Enrol in the “Introduction to the Personal Data (Privacy) Ordinance” Seminar
(www.pcpd.org.hk/english/education_training/individuals/public_seminars/public
_seminar.html).
ii) Download the powerpoint of "Introduction to the Personal Data (Privacy)
Ordinance
3
Enrolment
1. Please refer to the timetable on
www.pcpd.org.hk/english/education_training/organisations/workshops/workshop.html to
check whether the preferred class is still available.
2. Enrol online before the closing date.
3. Receive notification from us by email in a week after the closing date. Please
DO NOT send cheque payment until you are notified of the enrolment status. 4. Send a crossed cheque (with your full name at the back) payable to “Privacy
Commissioner For Personal Data” together with the original enrolment form by
post to Manager (Communications and Education), Office of the Privacy
Commissioner for Personal Data, Room 1303, 13/F, Sunlight Tower, 248 Queen’s
Road East, Wanchai, Hong Kong.
5. The PCPD will send you a confirmation email upon receipt of the full payment.
6. Enquiry: Please e-mail to [email protected] .
Adverse Weather Arrangement
If Typhoon Signal No. 8 or above/Black Rainstorm Warning is hoisted after (or is
announced to be held at/after) the following time, workshop will be cancelled.
Signal is hoisted after or is announced to be
held at/after*:
Workshops suspended
7:00 am Morning session
11:00 am Afternoon session
Participants will be given a refund if the workshop is cancelled.
* Even if Typhoon Signal No. 8 or above/Black Rainstorm Warning Signal has been
cancelled before the workshop commencement time.
4
Timetable of Professional Workshops on Data Protection
(August to December 2018)
Venue: (1) Preston Room 408-9, Fortress Tower, 250 King’s Road, North Point, Hong Kong
(Next to the Fortress Hill MTR Station)
(2) PCPD 12/F, Sunlight Tower, 248 Queen's Road East, Wanchai, Hong Kong
Date Time Course
Code Course Venue
Course
Fee*
Medium of
Instruction CPD Accreditation #
August 2018 (Closing date for enrolment: 21 August 2018) Law Soc
IA EAA HKICS
31 Aug 2:15-5:15
pm LAW-13
Practical Workshop on Data
Protection Law (1) Preston
$950/
$760* Cantonese ✔+
✔ ✔^
September 2018 (Closing date for enrolment: 24 August 2018)
5 Sep 2:15-5:15
pm DM-83
Data Protection in Direct
Marketing Activities (1) Preston
$750/
$600* Cantonese ✔+
✔ ✔ ✔
12 Sep 2:15-5:15
pm DAR-63
Data Protection and Data
Access Request (1) Preston
$750/
$600* Cantonese ✔+
✔ ✔ ✔
14 Sep 2:15-4:15
pm PMP-10
Privacy Management
Programme (1) Preston
$750/
$600* Cantonese ✔+
✔ ✔
17 Sep 2:15-5:15
pm BF-85
Data Protection in Banking/Financial Services
To be
confirmed
$750/
$600* Cantonese ✔+
✔ ✔^
20 Sep 2:15-5:15
pm DEC-04
Recent Court and Administrative Appeals Board Decisions
To be
confirmed
$950/
$760* English ✔+
✔ ✔^
26 Sep 2:15-5:15
pm INS-44 Data Protection in Insurance
To be
confirmed
$750/
$600* Cantonese ✔+
✔ ✔ ✔
28 Sep 2:15-5:15
pm HR-59 HR-59
Data Protection in Human Resource Management
To be
confirmed
$750/
$600* Cantonese ✔+
✔ ✔ ✔^
October 2018 (Closing date for enrolment: 26 September 2018)
9 Oct 2:15-5:15
pm DAR-64
Data Protection and Data Access Request
(2) PCPD $750/
$600* Cantonese ✔+
✔ ✔ ✔
15 Oct 2:15-5:15
pm BF-86
Data Protection in Banking/Financial Services
(2) PCPD $750/
$600* Cantonese ✔+
✔ ✔^
26 Oct 2:15-5:15
pm DEC-05
Recent Court and Administrative Appeals Board Decisions
(2) PCPD $950/
$760* Cantonese ✔+
✔ ✔^
November 2018 (Closing date for enrolment: 23 October 2018)
6 Nov 2:15-4:15
pm PMP-11
Privacy Management Programme
(2) PCPD $750/
$600* Cantonese ✔+
✔ ✔
9 Nov 2:15-5:15
pm HR-60
Data Protection in Human Resource Management
(2) PCPD $750/
$600* Cantonese ✔+
✔ ✔ ✔^
5
* Applicable to members of PCPD's Data Protection Officers' Club ("DPOC") and the supporting
organisations only.
# CPD hours/points are accredited by:-
Insurance Authority - Insurance Intermediaries Quality Assurance Scheme (IA); Estate Agents Authority (EAA); and Hong Kong Institute of Chartered Secretaries (HKICS).
The number of CPD hours/points obtained is determined by the number of hours of the respective course listed above. + Accreditation of the Law Society of Hong Kong (LawSoc) is being sought. ^ 3 ECPD hours are accredited by the HKICS. End time of all accredited courses will be extended 10 minutes to make up for the break.
All course materials are in English. Please contact the Communications and Education Division at 2877 7169/ 3423 6621 or [email protected] if you wish to attend the training conducted in English.
Date Time Course
Code Course Venue
Course
Fee*
Medium of
Instruction
CPD Accreditation #
November 2018 (Closing date for enrolment: 23 October 2018) Law Soc
IA EAA HKICS
26 Nov 2:15-5:15
pm INS-45 Data Protection in Insurance (2) PCPD
$750/
$600* Cantonese ✔+
✔ ✔ ✔
December 2018 (Closing date for enrolment: 20 November 2018)
4 Dec 2:15-5:15
pm LAW-14
Practical Workshop on Data
Protection Law (2) PCPD
$750/
$600* Cantonese ✔+
✔ ✔^
11 Dec 2:15-5:15
pm DM-84
Data Protection in Direct
Marketing Activities (2) PCPD
$750/
$600* Cantonese ✔+
✔ ✔ ✔
6
Data Protection in Human Resource Management
This workshop is designed for human resource practitioners learning how to meet the
requirements under the Personal Data (Privacy) Ordinance (“the Ordinance”) in
handling large amount of employees’ personal data in the different phases of
employment process.
Human resource practitioners handle a large amount of employee data in the course of
their work. The collection, use and retention of employee data carry significant legal
responsibilities and risks. It is therefore a great challenge for human resource
practitioners to meet the requirements under the Ordinance and the Code of Practice
on Human Resource Management. Participants will learn the good practices in
handling personal data in each phase of the employment process.
Who should attend: Human Resource Officers, Data Protection Officers,
Compliance Officers, Solicitors, Administration Managers, Recruitment Agents
Course outline:
- What are the general requirements for the collection and retention of personal data,
and ensuring their accuracy and security in each phase of the employment process
- What are the requirements of the Code of Practice on Human Resource
Management
- Collection of personal data in recruitment process e.g. medical data, reference data
- What is “Blind Recruitment Advertisement”
- What are the restrictions on keeping personal data, setting appropriate periods of
time for keeping information
- What are the legal requirements in transferring personal data to third parties
- Collection of biometrics data
- How to handle a Data Access Request by job applicants or employees
- What are the requirements for engaging in employee monitoring activities
7
Data Protection and Data Access Request
This workshop provides practical guidance on issues relating to compliance with a
Data Access Request (“DAR”) raised by customers or employees.
There are stringent requirements for compliance with a DAR under the Personal Data
(Privacy) Ordinance. Dealing properly and effectively with a DAR is a challenge for
many organisations. This workshop will examine in details those requirements and
offer guidance on the handling of a DAR.
Participants may already be dealing with DARs and want to review their handling or
may never have dealt with DARs and want to develop processes. They will learn
how to deal with DAR and avoid pitfalls. There will also be plenty of opportunity for
questions during the workshop.
Who should attend: Solicitors, Data Protection Officers, Administration Managers,
Human Resource Officers, Customer Services Personnel
Course outline:
- What is a DAR
- What is subject to access under a DAR
- Who may make a DAR
- How to make a DAR
- What should a data user do in order to comply with a DAR
- Charges for a DAR
- Grounds for refusing to comply with a DAR
- Steps to take in refusing to comply with a DAR
- Protection for third party data when complying with a DAR
- Consequences of breach of the DAR provisions
8
Practical Workshop on Data Protection Law
This workshop is aimed at anyone who wishes to acquire a solid grounding in the
application and interpretation of the provisions of the Personal Data (Privacy)
Ordinance (“the Ordinance”).
With the increase in public awareness on personal data protection, it becomes an
important aspect for organisations to gain customers’ trust and confidence. This
workshop (to be conducted by experienced lawyers from the Office of the Privacy
Commissioner for Personal Data) is for people who are charged with the
responsibility in advising on compliance with the Ordinance to acquire solid
knowledge through interactive participation.
Who should attend: Solicitors, Barristers, In-house Legal Counsels, Data Protection
Officers, Compliance Officers
Course outline:
- Examining the application of the six data protection principles with special
highlights on recent administrative appeals board and court cases
- Problems frequently encountered by organisations dealing with personal data,
including:-
o What are the points to consider when drafting a personal information
collection statement?
o How to respond to requests by law enforcement agencies for disclosure of
employees’ or customers’ personal data?
o What are the key aspects to be included in a privacy policy statement?
o What are the special requirements in complying with or refusing to comply
with a data access/correction request?
o How to comply with the direct marketing requirements in a joint marketing
campaign?
o What are the steps to take when outsourcing the processing of personal data
to agents located in or outside Hong Kong?
- Consequences of breach of the Ordinance and liabilities of key officers
- Case studies and discussion
9
Data Protection in Banking/Financial Services
This workshop examines the personal data privacy issues facing banking and
financial personnel in their daily operation and provides practical steps that can be
taken to deal with the issues effectively.
Banking and financial personnel face a lot of data protection challenges in a complex
business world where the business can be cross-jurisdictional or multi-functional.
This workshop will examine the requirements under the Personal Data (Privacy)
Ordinance in different aspects of the banking and financial services and the practical
ways to deal with them effectively.
Who should attend: Data Protection Officers, Compliance Officers, Company
Secretaries, Solicitors, Advisers and other personnel undertaking work relating to the
banking/financial industry.
Course outline:
- An overview of the relevant requirements under the Ordinance
- Liabilities of banks for acts of staff, agents and contractors
- Useful pointers on Personal Information Collection Statement
- Collection of identification document number from non-account holder
- Accuracy of customer’s contact information
- Retention and erasure of customers’ personal data
- Outsourcing the processing of personal data
- Transfer of personal data outside Hong Kong
- Handling of customers’ personal data in debt collection
- Protection of customers’ personal data collected during off-site marketing
campaign
- Handling of data access request from customers
- Make privacy policies and practices generally available
10
Data Protection in Insurance
This Workshop is designed for insurance practitioners who wish to acquire the
knowledge to protect customers’ personal data in providing insurance services to the
public. The course will highlight the key features of “Guidance on the Proper
Handling of Customers’ Personal Data for the Insurance Industry” and privacy issues
specific to insurance institutions and insurance practitioners.
Insurance practitioners handle a large amount of customers’ personal data in their
daily work e.g. name, telephone number, address, identity card number, health record,
information contained in insurance application forms and insurance policy etc. It is
essential that they understand and comply with the requirements under the Personal
Data (Privacy) Ordinance (“the Ordinance”) which apply to them in their capacities as
the data users in the handling of personal data.
This workshop examines core concepts of practical data protection compliance
illustrated by specific scenarios to highlight potential problems and their resolution.
Participants will also engage in discussion of real cases relating to the handling of
personal data in different aspects of insurance work.
Who should attend: Insurance Practitioners, Data Protection Officers, Compliance
Officers, Solicitors, Advisers and other personnel undertaking work relating to the
Insurance Industry
Course outline:
- An overview of the data protection provisions
- Liabilities of insurance companies and insurance practitioners
- Useful pointers on Personal Information Collection Statement
- Collection of customers’ medical data
- Collection of Hong Kong identity card number and copy
- Engagement of private investigators in insurance claims
- Retention of customers’ personal data
- Use of customers’ data for internal training
- Security of customers’ personal data handled by staff and agents
- Handling of data access requests from customers
11
Data Protection in Direct Marketing Activities
This workshop focuses on the collection and use of personal data for direct marketing
purposes. You will learn how to comply with the requirements under the Personal
Data (Privacy) Ordinance (“the Ordinance”) and put this into context with your
responsibilities in the company.
Direct marketing is widely adopted by different types of organisations in promoting
their products and services. In Hong Kong, the use of personal data in direct
marketing activities is governed by the Ordinance. Since the new direct marketing
regime took effect from 1 April 2013, some companies were convicted for failing to
comply with the requirements which present risks to a company’s value and consumer
trust.
This workshop provides a practical approach to the compliance of the requirements
under the Ordinance in direct marketing activities and provides hands-on solutions to
problems that marketers face in devising direct marketing activities. Conviction cases
will also be shared with the participants.
Who should attend: Data Protection Officers, Compliance Officers, Company
Secretaries, Administration Managers, IT Managers, Solicitors (in house or private
practice), Database Managers, Marketing professionals
Course outline:
- What is “Direct Marketing” under the Ordinance - understanding the Guidance on
the Collection and Use of Personal Data in Direct Marketing
- Collection of personal data from different sources for direct marketing purpose
- Legal requirements for using personal data in marketing activities
- What is “prescribed consent” in using customers’ personal data for direct
marketing purpose
- How to handle an "Opt-Out Request"
- How to maintain the opt-out list
- Legal requirements for carrying out direct marketing activities with a partner
company
- Sharing of conviction cases
12
Privacy Management Programme
Privacy and data protection cannot be managed effectively if they are merely treated
as a legal compliance issue. Instead, organisational data users should embrace
personal data privacy protection as part of their corporate governance
responsibilities and apply them as a business imperative throughout the
organisation. To this end, the formulation and maintenance of a comprehensive
Privacy Management Programme (PMP) is of paramount importance.
This course will highlight the key features of “Privacy Management Programme – A
Best Practice Guide”. Participants will be able to understand the baseline
fundamentals and components of a PMP and how to maintain and improve it on an
ongoing basis.
Who should attend: Data protection officers, compliance professionals, company
secretaries, solicitors, executives from business and public sectors, and those who are
interested in keeping abreast of the data protection trend and best practices.
Course outline:
- What is PMP
- Baseline Fundamentals of a PMP
- Ongoing Assessment and Revision
- How to develop your own PMP
13
Recent Court and Administrative Appeals Board Decisions
This workshop focuses on specific topics in data privacy law raised in recent
decisions of the Hong Kong Court and Administrative Appeals Board (the “Board”),
and aims at providing in-depth discussion and updated knowledge to legal
practitioners and compliance officers on the interpretation of commonly used
provisions of the Personal Data (Privacy) Ordinance (“the Ordinance”). This
intermediate level course is for participants who would like to gain more insights on
the legal arguments of court decisions and the Board cases.
The Board is the statutory body that hears and determines appeals against the
decisions of the Privacy Commissioner for Personal Data (“the Commissioner”) by a
complainant or the relevant data user complained of. The High Court of Hong Kong
deals with magistracy appeals against criminal offences committed under the
Ordinance. This workshop (to be conducted by experienced lawyers from the office
of the Commissioner) will examine some recent decisions which serve as legal
authorities and practical examples in solving problems frequently encountered in
compliance work.
Who should attend: Solicitors, Barristers, In-house Lawyers, Data Protection Officers,
Compliance Officers, Company Secretaries and Administration Managers.
Course outline:
A thorough discussion of the following decisions made by the High Court of Hong
Kong and the Board:-
HKSAR v Hong Kong Broadband Network Limited (HCMA 624/2015)
Does offering a new service contract to its existing customer at a concessionary
rate by a telecommunications company amount to “direct marketing” under the
Ordinance?
Do direct marketing offences require proof of mens rea?
What are the defences available to a data user?
HKSAR v Leung Chun-kit Brandon (HCMA 49/2016)
Do a person’s Christian name and mobile phone number together constitute his
personal data?
Is it a breach of section 35J of the Ordinance if a person passes his friend’s
contact particulars to an insurance agent for direct marketing purpose without
the friend’s consent? Would it make a difference if the insurance agent
ultimately has not so used the data for direct marketing?
14
AAB 17/2015 and AAB 18/2016
Will an organisation be liable for the disclosure of personal data by its
director? Under what circumstances will the director be regarded as exceeding
the realm of his authority?
Does the exemption under section 58(2) apply to the situation where a party
seeks to defend an allegation of unlawful or seriously improper conduct?
AAB 42/2016
How to determine whether a fee imposed for compliance with a data access
request is excessive?
What are the costs directly related to and necessary for complying with a data
access request?
Is a doctor’s cost of reviewing the medical records before releasing to the
requestor chargeable?
AAB 40/2016
How should a bank fulfill its obligations under Data Protection Principle 1(3) to
notify its customers of its personal data collection purpose of detecting or
combating financial crimes AND to avoid alerting the customers who may then
take pre-emptive and counter measures?
Would it suffice for a bank to request updated personal data from its customers
by simply informing them of the purpose of such use “in general terms”?