CIPP-A Sample Questions & Answers

As of early 2025, Section 33 of the PDPO has not yet come into effect. While it is part of the ordinance, its implementation has been deferred. Therefore, organizations in Hong Kong currently rely on other measures like contractual clauses and consent to ensure protection for cross-border data transfers, rather than the specific mechanisms outlined in Section 33.

The APEC CBPR system is a voluntary, accountability-based system. Its goal is not to create a single law but to build trust in cross-border data flows by allowing companies to be certified by an 'Accountability Agent' as compliant with the APEC Privacy Framework. This certification helps bridge differences between national privacy laws and facilitates data transfers between participating APEC economies.

Under Singapore's PDPA, data breach notification to the PDPC is mandatory if (1) the breach is likely to result in significant harm to an individual, OR (2) the breach affects 500 or more individuals. The source of the breach (vendor error) or the type of data (health information) are factors in assessing harm, but the notification triggers are the 'significant harm' threshold and the 'scale' threshold (500 individuals).

DPP2 explicitly states that personal data should not be kept for longer than is necessary to fulfill the purpose for which it was collected. Keeping recordings indefinitely without a clear, time-bound justification directly contravenes the duration of retention aspect of this principle. While other DPPs might be relevant, the core violation here is the lack of a retention policy.

The DPDPA imposes additional compliance burdens on organizations designated as Significant Data Fiduciaries. Key among these are the mandatory appointment of a Data Protection Officer (DPO) who must be based in India, and the requirement to undertake periodic Data Protection Impact Assessments (DPIAs) to evaluate and mitigate risks associated with their data processing activities.

The Openness Obligation under Singapore's PDPA requires organizations to develop and implement policies and practices to meet their obligations and to make information about these policies and practices publicly available. A key, explicit requirement is to provide the business contact information of a person (the DPO) who can answer questions about the organization's data protection practices.

The OECD's Individual Participation Principle is the precursor to modern access and correction rights. It establishes that individuals should have the right to: (a) obtain confirmation about data relating to them; (b) have that data communicated to them within a reasonable time and in an intelligible form; (c) be given reasons if a request is denied and be able to challenge the denial; and (d) challenge the data's accuracy and have it erased, rectified, completed, or amended if the challenge is successful.

The PDPO provides a specific exemption for journalism and news media activities. This exemption applies if the use of the personal data is for publication or broadcast, the data user has reasonable grounds to believe that publishing or broadcasting is in the public interest, and the use is compatible with the professional activities of journalism. This is the most direct and applicable defense in this scenario.

The DPDPA establishes a tiered approach to dispute resolution. Before a Data Principal can escalate a complaint to the Data Protection Board, they must first attempt to resolve the issue directly with the Data Fiduciary through its established grievance redressal mechanism. This 'exhaustion of remedies' is a prerequisite for approaching the Board.

Elegance HK has likely breached DPP1 and DPP3. The use of a pre-ticked checkbox for consent is an unfair means of collection (breaching DPP1), as consent for direct marketing must be explicit. Sharing the data with third-party partners without clear, specific consent for that disclosure is a breach of DPP3, which limits the use of personal data to the purposes for which it was collected or a directly related purpose, unless voluntary and explicit consent is obtained.