### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

63A. Human embryos, etc.
(1) Personal data which consists of information showing that an identifiable individual was, or may have been, born in consequence of a reproductive technology procedure within the meaning of the Human Reproductive Technology Ordinance (Cap. 561) is exempt from the provisions of data protection principle 6 and section 18(1)(b) except so far as its disclosure under those provisions is made in accordance with section 33 of that Ordinance.
(2) Where a data access request relates to personal data which is or, if the data existed, would be exempt from section 18(1)(b) by virtue of subsection (1), then the data is also exempt from section 18(1)(a) if the interest protected by that exemption would be likely to be prejudiced by the disclosure of the existence or non-existence of the data.
(Added 47 of 2000 s. 48. Amended 18 of 2012 s. 2)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

63B. Due diligence exercise
(1) Personal data transferred or disclosed by a data user for the purpose of a due diligence exercise to be conducted in connection with a proposed business transaction that involves—
(a) a transfer of the business or property of, or any shares in, the data user;
(b) a change in the shareholdings of the data user; or
(c) an amalgamation of the data user with another body,

is exempt from the provisions of data protection principle 3 if each of the conditions specified in subsection (2) is satisfied.
(2) The conditions are—
(a) the personal data transferred or disclosed is not more than necessary for the purpose of the due diligence exercise;
(b) goods, facilities or services which are the same as or similar to those provided by the data user to the data subject are to be provided to the data subject, on completion of the proposed business transaction, by a party to the transaction or a new body formed as a result of the transaction;
(c) it is not practicable to obtain the prescribed consent of the data subject for the transfer or disclosure.
(3) Subsection (1) does not apply if the primary purpose of the proposed business transaction is the transfer, disclosure or provision for gain of the personal data.
(4) If a data user transfers or discloses personal data to a person for the purpose of a due diligence exercise to be conducted in connection with a proposed business transaction described in subsection (1), the person—
(a) must only use the data for that purpose; and
(b) must, as soon as practicable after the completion of the due diligence exercise—
(i) return the personal data to the data user; and
(ii) destroy any record of the personal data that is kept by the person.
(5) A person who contravenes subsection (4) commits an offence and is liable on conviction to a fine at level 5 and to imprisonment for 2 years.
(6) In this section—
due diligence exercise (盡職審查), in relation to a proposed business transaction, means the examination of the subject matter of the transaction to enable a party to decide whether to proceed with the transaction;
provision for gain (為得益而提供), in relation to personal data, means provision of the data in return for money or other property, irrespective of whether—
(a) the return is contingent on any condition; or
(b) the person who provides the data retains any control over the use of the data.

(Added 18 of 2012 s. 35)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

63C. Emergency situations
(1) Personal data is exempt from the provisions of data protection principle 1(3) and data protection principle 3 if the application of those provisions to the data would be likely to prejudice any of the following matters—
(a) identifying an individual who is reasonably suspected to be, or is, involved in a life-threatening situation;
(b) informing the individual’s family members or relevant persons of the individual’s involvement in the life-threatening situation; (Amended 32 of 2021 s. 5)
(c) the carrying out of emergency rescue operations or provision of emergency relief services.
(2) (Repealed 32 of 2021 s. 5)(Added 18 of 2012 s. 35)

63D. Transfer of records to Government Records Service
Personal data contained in records that are transferred to the Government Records Service is exempt from the provisions of data protection principle 3 when the records are used by the Government Records Service solely for the purpose of—
(a) appraising the records to decide whether they are to be preserved; or
(b) organizing and preserving the records.
(Added 18 of 2012 s. 35)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

64A. Miscellaneous offences
(1) A data user who, without reasonable excuse, contravenes any requirement under this Ordinance commits an offence and is liable on conviction to a fine at level 3.
(2) Subsection (1) does not apply in relation to—
(a) a contravention of a data protection principle;
(b) a contravention that constitutes an offence under section 14(11), 14A(6), (7) or (8), 15(4A) or (7), 18(5), 22(4), 31(4), 32(5), 44(10), 46(11), 50A(1) or (3), 50B(1), 63B(5) or 64(1), (3A) or (3C); or
(c) a contravention of any requirement under Part 6A or 9A. (Amended 32 of 2021 s. 7)
(Added 18 of 2012 s. 37. Amended E.R. 1 of 2013)

64B. Prosecution deadline for summary offences
(1) A prosecution for a summary offence under this Ordinance may only be started before the end of 2 years after the date on which the offence is committed.
Note—This replaces the time limit under section 26 of the Magistrates Ordinance (Cap. 227).
(2) In this section—
summary offence (簡易程序罪行) means an offence triable summarily only.
(Replaced 32 of 2021 s. 8)

64C. Prosecution of offences by Commissioner
(1) The Commissioner may prosecute in the name of the Commissioner—
(a) an offence under section 64(1) or (3A), 66E(1) or (5), 66I(1) or 66O(1); or
(b) an offence of conspiracy to commit such an offence.
(2) Any offence prosecuted under subsection (1) must be tried before a magistrate as an offence that is triable summarily.
(3) This section does not derogate from the powers of the Secretary for Justice in respect of the prosecution of criminal offences.
(Added 32 of 2021 s. 9)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

65. Liability of employers and principals
(1) Any act done or practice engaged in by a person in the course of his employment shall be treated for the purposes of this Ordinance as done or engaged in by his employer as well as by him, whether or not it was done or engaged in with the employer’s knowledge or approval.
(2) Any act done or practice engaged in by a person as agent for another person with the authority (whether express or implied, and whether precedent or subsequent) of that other person shall be treated for the purposes of this Ordinance as done or engaged in by that other person as well as by him.
(3) In proceedings brought under this Ordinance against any person in respect of an act or practice alleged to have been done or engaged in, as the case may be, by an employee of his it shall be a defence for that person to prove that he took such steps as were practicable to prevent the employee from doing that act or engaging in that practice, or from doing or engaging in, in the course of his employment, acts or practices, as the case may be, of that description.
(4) For the avoidance of doubt, it is hereby declared that this section shall not apply for the purposes of any criminal proceedings.