Standard Contract for Cross-boundary Flow of Personal Information involving Transfer of Credit Data through Credit Reference Agencies

Our Ref： B4/1C B9/32C B9/218C 28 June 2024 The Chief Executive All Authorized Institutions Dear Sir / Madam, Standard Contract for Cross-boundary Flow of Personal Information involving Transfer of Credit Data through Credit Reference Agencies The Innovation, Technology and Industry Bureau and the Cyberspace Administration of China announced on 13 December 2023 a facilitation measure on “Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong)”1 and its early and pilot implementation arrangements, and invited participation in such pilots from, among others, the banking and credit referencing sectors. The standard contract and the pilot implementation arrangements aim to foster and safeguard the cross-boundary flow of personal information in an orderly manner. With the implementation of the facilitation measure on the Greater Bay Area (“GBA”) Standard Contract, the compliance costs of cross-boundary personal data flow for organisations will be greatly reduced, thereby facilitating the provision of relevant cross-boundary services in the GBA and bringing convenience to the public and businesses. The GBA Standard Contract also promotes the development of the GBA’s digital economy and helps Hong Kong better integrate into the national development. 1 Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong): https://www.itib.gov.hk/en/speeches/2023/pr_20231213.html

• 2 - In this context, Authorized Institutions (“AIs”) participating in such pilots may be sharing and/or using consumer credit data and commercial credit data through Credit Reference Agencies (“CRAs”) in Hong Kong and/or on the Mainland. AIs participating in the pilots are reminded to comply with the requirements under the Personal Data (Privacy) Ordinance (Cap. 486) when handling cross￾boundary flow of consumer credit data or commercial credit data where personal data is involved. The requirements set out in the Code of Practice on Consumer Credit Data issued by the Privacy Commissioner for Personal Data should also be observed. In the case of consumer credit data, AIs should also, where relevant and practical, observe the guidance in the Supervisory Policy Manual (“SPM”) module on “The Sharing and Use of Consumer Credit Data through Credit Reference Agencies” (“IC-6”). In particular, AIs participating in the pilots should pay attention to Section 5 of the SPM to ensure that the cross-boundary data are properly safeguarded with regard to security and confidentiality, as well as Section 7 of the SPM on engagement of CRAs. In the case of commercial credit data, AIs should also observe the guidance in the SPM module on “The Sharing and Use of Commercial Credit Data through a Commercial Credit Reference Agency” (“IC-7”) and other relevant requirements. Should you have any questions regarding this circular, please contact Ms. Jessica Szeto or Mr. Jack Wat at 2597 0848 on matters relating to cross￾boundary credit referencing, or Ms. Cora Ching or Ms. Ivy Lo at 2878 1708 on matters relating to the SPMs. Yours faithfully, Alan Au Executive Director (Banking Conduct) c.c. The Chairman, The Hong Kong Association of Banks The Chairman, The DTC Association Secretary for Financial Services and the Treasury (Attn: Mr Justin To)