HKMA Circular on Personal Data (Privacy) Ordinance Compliance for Authorized Institutions

Hong Kong Monetary Authority fds HTL Annex III D T R Carse JP fi AL JP Deputy Chief Executive AE A Our Ref.: G4/32C 24 May 2002 Managers of authorized institutions under the Banking Ordinance Dear Sir/Madam, Personal Data (Privacy) Ordinance Pursuant to the Personal Data (Privacy) Ordinance (the Ordinance), this letter informs managers of all authorized institutions of the purpose for which their data to be collected by the Monetary Authority (MA) are to be used and the classes of persons to whom the data may be transferred. Section 2 of the Banking Ordinance defines the meaning of “manager” (copy at Annex 1). Pursuant to section 72B of the Banking Ordinance (copy at Annex 2), authorized institutions are required to provide the particulars (e.g. Hong Kong Identity Card number or passport number) of an individual who has been appointed as a manager or has ceased to be a manager to the MA not later than 14 days after the date of such appointment or cessation. The notification requirement under section 72B also applies to the subsequent changes to such appointment, for example, changes in the responsibilities of the manager. The data relating to the managers are collected and used for the exercise of the functions of the MA set out in section 7 of the Banking Ordinance (copy at Annex 3), the principal one of which is to promote the general stability and effective working of the banking system. The MA will treat all data about the managers of authorized institutions in accordance with the Ordinance. Disclosure of such data may however be made to other persons, including other local and overseas supervisors in the circumstances set out in sections 120 and 121 of the Banking Ordinance (copy at Annex 4). In accordance with the terms of the Ordinance and subject to the exemptions set out in section 58 of the Ordinance. any individual - 30th Floor 3 Garden Road Hong Kong fit FE 35% 30 樓 Telephone (852) 2878-1688 Facsimile (852) 2878-1690 電話 (852) 2878-1688 [al x {diy (852) 2878-1690 E-mail David_TR_Carse@hkma.gov.hk 電子郵件 David_TR_Carse@hkma.gov.hk HomePage http://wwwinfo.gov.hk/hkma 網 頁 http:/www.info.gov.hk/hkima Telex 64282 COFB HX 二訊號碼 64282 COFB HX

(a) has the right to check whether the MA holds data about him and the right of access to such data; (b) has the right to require the MA to correct any data relating to him which is inaccurate; and (¢) has the right to ascertain the MA’s policies and practices in relation to data and to be informed of the kind of personal data held by the MA. In accordance with the terms of the Ordinance, the MA has the right to charge a reasonable fee for the processing of any data access request. You may address requests for access to data or correction of data or for information regarding policies and practices and kinds of data held to the following person - The Data Protection Officer Hong Kong Monetary Authority 30/F, 3 Garden Road Central, Hong Kong Telephone : 2878-1641 Fax : 2878-8214 Yours faithfully. (D TR Carse) Deputy Chief Executive Encl.

CAP. 155 2(1) Extract of Banking Ordinance — Section 2 Banking “manager” (經 理 ) (a) (b) (0) subject to paragraph (co, in relation to an authorized institution incorporated In Hong Kong, means any individual, other than a director or chief executive of the institution, appointed by the institution, or by a person acting for or on behalf of or by an arrangement with the institution, to be principally responsible, cither alone or with others, for the conduct of any one or more of the affairs or business of the institution specified in the Fourteenth Schedule; subject to paragraph (c), in relation to an authorized institution incorporated outside Hong Kong, means any individual, other than a chief executive of the institution, appointed by the institution, or by a person acting for or on behalf of or by an arrangement with the institution, to be principally responsible, either alone or with others, for the conduct of any one or more of the affairs or business in Hong Kong of the institution specified in the Fourteenth Schedule; does not include a person, or a person belonging to a class of persons, declared in a notice under subsection (14)(cb) not to be a manager, or a class of managers, as the case may be, for the purposes of this definition. Annex 1

Extract of Banking Ordinance — Fourteenth Schedule CAP. 155 Banking FOURTEENTH SCHEDULE AFFAIRS OR BUSINESS OF AUTHORIZED INSTITUTIONS SPECIFIED FOR PURPOSES OF DEFINITION or “MANAGER"

1. In this Schedule一 “banking or other financial services” (銀行 或其他財逆服務) includes the taking of deposits, the provision of payment and remittance services, the issuance of credit, debit or multi￾purpose cards, facilities for the purchase or sale of foreign currencies, securities or other financial instruments, the provision of financial advice and the incurring of financial exposure mentioned in section 81(2) of this Ordinance; : “corporate banking” (公司 銀行業務), in relation to an authorized institution, means the provision by the institution of banking or other financial services to companies, but does not include such services so provided as part of the institution's retail banking; “institutional banking” (機權銀行業務), in relation to an authorized institution, means the provision by the institution of banking and other financial services to authorized institutions, banks incorporated outside Hong Kong which are not authorized institutions or other financial institutions; “international banking” (國 際 銀行業務), in relation to an authorized institution incorporated in Hong Kong, means the provision of banking or other financial services through overseas offices or subsidiaries of the institution; “private banking” (私人 銀行業務), in relation to an authorized institution, means the provision by the institution of banking or other financial services to individuals who are considered by the institution to be of high net worth, but does not include such services so provided as part of the institution's retail banking; “retail banking” (EE{RITHEIS), in relation to an authorized institution, means the provision by the institution of banking or other financial services to individuals, firms, partnerships, unincorporated businesses or companies; “treasury” (財政 管理 ), in relation to an authorized institution, means the management by the institution of the liquidity and funding of the Institution and the trading of foreign currencies, securities or other financial instruments.
2. The carrying on of business of any of the following descriptions or of any of their equivalents within an authorized institution— (a) retail banking; (b) private banking; (c) corporate banking; (d) international banking; (¢) institutional banking; treasury; or (g) any other business which is material to the institution. 3 The maintenance of the accounts or the accounting systems of an authorized institution.
3. The maintenance of systems of control of an authorized institution, including those systems intended to manage the risks of the institution. 5 The maintenance of systems of control of an authorized institution to protect it against involvement in money laundering.
4. The development, operation-and maintenance of computer systems for an authorized institution.
5. The conduct of internal audits or inspections of the institution's affairs or business. €. The function of ensuring that an authorized institution complies with laws, regulations or guidelines that are applicable to it.

Extract of Banking Ordinance — Section 72B CAPD. 155 Banking “72B. Notification of appointment of manager, cfc. (1) Subject to subsections (2) and (3), an authorized institution shall, not later than 14 days after the date on which a person— (a) became a manager of the institution; (b) ceased to be a manager of the institution; or (¢) in his capacity as a manager of the instutution, became principally responsible, either alone or with others, for any of the affairs or business of the institution specified in the Fourteenth Schedule in addition to, or in place of, any other such responsibility he has or had in that capacity, give notice in writing to the Monetary Authority and the person of— (i) that date; (ii) particulars of the affairs or business of the institution in relation to which the person became or has ceased to be such manager (including any case which falls within paragraph (c)); and (ii) in the case of the notice to the Monetary Authority, such other particulars of the person as the Monetary Authority may require for the exercise of his functions under this Ordinance. (2) Subject to subsection (3), an authorized institution is not required to comply with subsection (1) in respect of a manager appointed bona fide on a temporary basis. (3) Where in respect of the appointment of a manager— (a) an authorized institution has not complied with subsection (1) by virtue of subsection (2); and (b) the appointment subsequently ceases to be on a temporary basis, then— (i) subsection (1) shall, on the date on which that cesser occurs, apply in respect of the manager; and (i1) that date shall be the date mentioned in subsection (1) {rom which the period mentioned in that subsection shall be calculated within which the institution shall comply with that subsection in respect of the manager. (4) Every director, every chief executive and every manager of an authorized institution which contravenes subsection (1) commits an offence and is liable— (a) on conviction upon indictment to a fine at tier 7 and to imprisonment for 2 years; or (6) on summary conviction to a fine at tier 5 and to imprisonment for 6 months, and, in the case of a continuing offence, to a further fine at tier 2 for every day during which the offence continues.”

CAP. 155 Banking Extract of Banking Ordinance — Section 7 7. Functions of Monctary Authority (1) The principal function of the Monctary Authority under this Ordinance shall be to promote the general stability and effective working of the banking system. (Amended 82 of 1992 s. 15) (2) Without limiting the generality of subsection (1), the Monetary Authority shall- (Amended 82 of 1992 5.25) (a) (b) (c) (d) (©) ® be responsible for supervising compliance with the provisions of this Ordinance; take all reasonable steps to ensure that the principal places of business, local branches, overseas branches and overseas representative offices of all authorized institutions and local representative offices are operated in a responsible, honest and business-like manner; promote and encourage proper standards of conduct and sound and prudent business practices amongst authorized institutions and money brokers; (Amended 4 of 1997 5. 4) suppress or aid in suppressing illegal, dishonourable or improper practices in relation to the business practices of authorized institutions; co-operate with and assist recognized financial services supervisory authoritics of Hong Kong or of any place outside Hong Kong, whenever appropriate, to the extent permitted by this or any other Ordinance; and (Amended 95 of 1991 5. 4) consider and propose reforms of the law relating to banking business and the business of taking deposits. (3) The Monetary Authority may from time to time cause to be prepared and published by notice in the Gazette, for the guidance of authorized institutions, guidelines not inconsistent with this Ordinance, indicating the manner in which he proposes to exercise functions conferred or imposed by this Ordinance upon him. (Amended 82 of 1992 5. 25)

Extract of Banking Ordinance — Section 120 CAPD. 155 Banking 120. Official secrecy (1) Except as may be necessary for the exercise of any function uader this Ordinance or foc carrying iato cffect the provisions of this Ordinance, every person to whom this subsection applics- (Amended 64 of 1987 5. 26) (a) shall preserve and aid in preserving secrecy with regard (o all matters relating to the affairs of any person that may come to his knowledge in the exercise of any {function under this Ordinance; (b) shall not communicate any such matter to any person other than the person to whom such matter relates; and (c) shall not suffer or permit any person to have access to any records in the possession, custody or control of any person to whom this subsection applies. (2) Subsection (1) shall apply to any person who is or has been- (a) a public officer; (b) a person authorized by the Monetary Authority; (c) the Advisor of an authorized institution; (Replaced 49 of 1995 5.36) (d) the Manager of an authorized institution; (Replaced 49 of 1995s. 36) (da) a person appointed under section 5$3G(5); (Added 49 of 1995 s. 36) (e) a person appointed under section 117(2); and (f) a person employed by or assisting a person to whom this subsection applies by virtue of paragraph (b), (¢), (d), or (e), who exercises or has exercised any function under this Ordinance. (3) Subsection (1) shall not apply if the Manager of an authorized institution is required to comply with a notice to furnish returns and information under section 51 of the Inland Revenue Ordinance (Cap 112). (Replaced 49 of 1995 s. 36) (4) No person who exercises any function in the course of an examination or investigation under section 47, 50, 55 or 117 or who receives reports, returns or information submitted under section 47, 50, 55, 56, 59, 63 or 64 shall be required to produce in any court any book, account or other document whatsoever or to divulge or communicate to any court any matter or thing coming under his notice in the exercise of his functions under this Ordinance, except as may be necessary in the course of a prosecution for any offence or of a winding-up by the Court of First Instance under section 122. (Amended 67 of 19925. 9; 25 of 1998 5.2) (5) Subsection (1) shall not apply- (a) to the disclosure of information in the form of a summary of similar information provided by a number of authorized institutions if the summary is so framed as to prevent particulars relating to the business of any particular authorized institution being ascertained from it; (b) to the disclosure of information with a view to the institution of, or otherwise for the purposes of, any criminal proceedings, whether under this Ordinance or otherwise; (c) in connection with any other legal proceedings arising out of this Ordinance; (d) to the disclosure of information to the police or the Independent Commission Against Corruption, at the request of the Secretary for Justice, relevant to the proper investigation of any criminal complaint; (Amended L.N. 362 of 1997) (c) to the disclosure of information by the Monetary Authority with a view to the institution of, or otherwise for the purposes of, any disciplinary proceedings relating to the exercise of his professional duties by an auditor or former auditor of an authorized institution or former authorized institution, whether or not the auditor or former auditor, as the case may be, was appointed under section 50, 59 or 63; (Replaced 43 of 1990 5. 9. Amended 67 of 19925. 9) (f) to the disclosure of information by the Monetary Authority to the Chief Executive, the Financial Secretary, the Secretary for Financial Services, an inspector appointed by the Financial Secretary to investigate the affairs of a company, a person holding an authorized statutory office or any public officer

authorized by the Financial Secretary for the purposes of this paragraph where, ia the opinion of the Monetary Authority- (Amended L.N. 96 of 1993; 68 of 1999 5.3) (i) itis desirable or expedient that information should be so disclosed in the interests of depositors or potential depositors or the public interest; or (it) such disclosure will enable ar assist the recipient of the information to exercise his functions and it is not contrary to the interests of depositors or potential depositors or the public interest that the information should be so disclosed; (Replaced 95 of 1991 5. 40) (g) to the disclosure of information by the Monetary Authority to an auditor of an authorized institution or former autharized iastitution, or to a former auditor, for the purpose of enabling or assisting the Monctary Authority to discharge his functions under this Ordinance; (Replaced 43 of 1990s. 9. Amended L.N. 276 of 1990; 95 of 1991 5. 40) (ga) to the disclosure of information- (i) to any person appointed under section SA(3) of the Exchange Fund Ordinance (Cap 66); and (ii) where such disclosure will enable or assist such person to assist the Monetary Authority in the performance of any of the functions referred to in that section; (Added 49 of 1995s. 36) (h) subject to subsection (5D), to the disclosure of information by the Monetary Authority with the consent of- (i) the person from whom the information was obtained or received; and (ii) where the information does not relate to such person, the person to whom it relates; or (Added 95 of 1991 s. 40) (i) to the disclosure of information which has been made available to the public by virtue of being disclosed in any circumstances in which, or for any purpose for which, disclosure is not precluded by this section or section 121. (Added 95 of 1991 s. 40) (5A) For the purposes of subsection (5)(f), “authorized statutory office” 認可 法定職位) means- . (a) the Insurance Authority under the Insurance Companies Ordinance (Cap 41); (Amended 10 of 1989 s. 65) (b) the Securities and Futures Commission; or (Replaced 10 of 1989s. 65) (c) the Mandatory Provident Fund Schemes Authority established by section 6 of the Mandatory Provident Fund Schemes Ordinance (Cap 485). (Added 4 of 19985. 7) (d) (Repealed 10 of 1989 5. 65) (Added 68 of 1988 5. 2. Amended 4 of 1998 5. 7) (5B) The Legislative Council may, by resolution, amend subsection (SA). (Added 68 of 1988 s. 2) (5C) The Monetary Authority may attach a condition to any disclosure of information made pursuant to subsection (S)(b), (c), (d), (e), (1) or (ga) and shall attach a condition to any disclosure of information made pursuant to subsection (5)(g), that neither- (Amended 49 of 1995 5.36) (a) (he person to whom the information has been disclosed; nor (b) any person obtaining or receiving the information (whether directly or indirectly) from the person referred to in paragraph (a), shall disclose that information to any other person without the consent of the Monetary Authority. (Added 95 of 1991 s. 40) (5D) Subsection (5)) shall not operate to require the Monetary Authority to disclose in or in relation to any civil proceedings any information which he may disclose, or has disclosed, pursuant to that subsection. (Added 95 of 1991 s. 40. Amended 94 of 1993 5. 28) (6) Any person who- (a) contravenes subsection (1);

(b) aids, abets, counsels or procures any person to contravene subsection (1); or (c) knowing that the condition referred to in subsection (SC) has been attached to a disclosure of information made pursuant to subsection (5), contravenes, or aids, abets, counsels or procures any person to contravene, that condition, (Added 95 of 1991 s. 40) commits an offence and is liable- (i) on conviction upon indictment to a fine at tier § and to impcisonment for 2 years; or (ii) on summary conviction to a fine at tier 5 and to imprisonment for 6 months. (Amended 4 of 1997 5. 27) (7) Subsection (5)a), (¢) and (g) shall apply to and in relation to approved money brokers and former approved money brokers as it applies to and in relation to authorized institutions and former authorized institutions respectively, and the other provisions of this Ordinance shall be construed accordingly. (Added 4 of 1997 5. 17) (Amended 3 of 1990 s. 46; 82 of 1992 5. 20)

Extract of Banking Ordinance — Section 121 CAPD. 155 Banking 121. Disclosure of information relating to authorized iastitutions (1) Subject to subsection (3), and notwithstanding section 120, the Monetary Authority may disclose information to an authority in a place outside Hong Kong where- (a) that authority exercises functions in that place corresponding to the functions of- (i) the Monetary Authority; or : (ii) an authorized statutory office within the meaning of section 120(5A); and (b) in the opinion of the Monetary Authority- (i) that authority is subject to adequate secrecy provisions in that place; and (ii) it is desirable or expedient that information should be so disclosed in the interests of depositors or potential depositors or the public interest; or (iii) such disclosure will enable or assist the recipient of the information to execcise his functions aad it is not contrary to the interests of depositors or potential depositors or the public interest that the information should be so disclosed. (Replaced 95 of 1991 s. 41) (2) Subject to subsection (3) and notwithstanding section 120, the Monetary Authority may, if he considers that it is in the interests of customers of the representative office, provide to the appropriate recognized banking supervisory authority of a place outside Hong Kong which is, in his opinion, subject to adequate secrecy provisions in that place information on matters relating to the affairs of a local representative office which is maintained by a bank incorporated in that place or in respect of which the Moqetary Authority is of the opinion that the authority has primary supervisory responsibility. (Amended 49 of 1995.37) (2A)(Repealed 95 of 1991 5. 41) (3) The Monetary Authority- (a) may, subject to paragraph (b), attach a condition to any disclosure of information made pursuant to this section; (b) shall, to the extent that any disclosure of information made pursuant to this section relates to the affairs of any individual customer of an authorized institution or a local representative office, attach a condition, that neither- (i) the person to whom the information has been disclosed; nor (ii) any person obtaining or receiving the information (whether directly or indirectly) from the person referred to in paragraph (i), shall disclose that information to any other person without the consent of the Monetary Authority. (Replaced 42 of 1999 s. 12)