### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

31. Matching procedure request
(1) A data user proposing to carry out, whether in whole or in part, a matching procedure may make a request—
(a) in the specified form;
(b) to the Commissioner; and
(c) seeking the Commissioner’s consent under section 32 to the carrying out of that procedure.
(2) Where 2 or more data users may each make a matching procedure request in respect of the same matching procedure, then any of those data users may make such a request on behalf of all those data users, and the provisions of this Ordinance (including subsection (1)) shall be construed accordingly.
(3) Without prejudice to the generality of subsection (2), it is hereby declared that a matching procedure request may be made in relation to 2 or more matching procedures, or a series of matching procedures, and the other provisions of this Ordinance (including section 32) shall be construed accordingly.
(4) A data user who, in a matching procedure request made under subsection (1), supplies any information which is false or misleading in a material particular for the purpose of obtaining the Commissioner’s consent to the carrying out of the matching procedure to which the request relates, commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 18)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

32. Determination of matching procedure request
(1) The Commissioner shall determine a matching procedure request—
(a) not later than 45 days after receiving the request; and
(b) by taking into account the prescribed matters applicable to the request and—
(i) where he is satisfied as to those matters, serving a notice in writing on the requestor stating that he consents to the carrying out of the matching procedure to which the request relates subject to the conditions, if any, specified in the notice;
(ii) where he is not so satisfied, serving a notice in writing on the requestor stating—
(A) that he refuses to consent to the carrying out of the matching procedure to which the request relates; and
(B) such of those matters in respect of which he is not so satisfied and the reasons why he is not so satisfied.
(2) For the avoidance of doubt, it is hereby declared that a consent in a notice under subsection (1)(b)(i) to the carrying out of a matching procedure to which a matching procedure request relates shall not operate to prevent a data user who is neither the requestor nor, where section 31(2) applies to the request, any data user on whose behalf such request was made, from carrying out, whether in whole or in part, the procedure.
(3) An appeal may be made to the Administrative Appeals Board—
(a) against—
(i) any conditions specified in a notice under subsection (1)(b)(i); or
(ii) any refusal specified in a notice under subsection (1)(b)(ii); and
(b) by the requestor on whom the notice was served or any data user on whose behalf the matching procedure request concerned was made.
(4) In this section, prescribed matter (訂明事宜) means a matter specified in Schedule 5.
(5) A requestor who contravenes any conditions specified in a notice under subsection (1)(b)(i) commits an offence and is liable on conviction to a fine at level 3. (Added 18 of 2012 s. 19)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

33. Prohibition against transfer of personal data to place outside Hong Kong except in specified circumstances
(Not yet in operation)
(1) This section shall not apply to personal data other than personal data the collection, holding, processing or use of which—
(a) takes place in Hong Kong; or
(b) is controlled by a data user whose principal place of business is in Hong Kong.
(2) A data user shall not transfer personal data to a place outside Hong Kong unless—
(a) the place is specified for the purposes of this section in a notice under subsection (3);
(b) the user has reasonable grounds for believing that there is in force in that place any law which is substantially similar to, or serves the same purposes as, this Ordinance;
(c) the data subject has consented in writing to the transfer;
(d) the user has reasonable grounds for believing that, in all the circumstances of the case—
(i) the transfer is for the avoidance or mitigation of adverse action against the data subject;
(ii) it is not practicable to obtain the consent in writing of the data subject to that transfer; and
(iii) if it was practicable to obtain such consent, the data subject would give it;
(e) the data is exempt from data protection principle 3 by virtue of an exemption under Part 8; or (Amended 18 of 2012 s. 2)
(f) the user has taken all reasonable precautions and exercised all due diligence to ensure that the data will not, in that place, be collected, held, processed or used in any manner which, if that place were Hong Kong, would be a contravention of a requirement under this Ordinance.
(3) Where the Commissioner has reasonable grounds for believing that there is in force in a place outside Hong Kong any law which is substantially similar to, or serves the same purposes as, this Ordinance, he may, by notice in the Gazette, specify that place for the purposes of this section.
(4) Where the Commissioner has reasonable grounds for believing that in a place specified in a notice under subsection (3) there is no longer in force any law which is substantially similar to, or serves the same purposes as, this Ordinance, he shall, either by repealing or amending that notice, cause that place to cease to be specified for the purposes of this section.
(5) For the avoidance of doubt, it is hereby declared that—
(a) for the purposes of subsection (1)(b), a data user which is a company incorporated in Hong Kong is a data user whose principal place of business is in Hong Kong;
(b) a notice under subsection (3) is subsidiary legislation; and
(c) this section shall not operate to prejudice the generality of section 50.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35. Repeated collections of personal data in same circumstances
(1) A data user who—
(a) has complied with the provisions of data protection principle 1(3) in respect of the collection of any personal data from the data subject (first collection