Hong Kong has joined an agreement with binding commitments to open transfers of data across borders: the Australia - Hong Kong Free Trade Agreement and associated Investment Agreement [Art. 11.7(2) and 11.15(1)].

The Personal Data (Privacy) Ordinance, as amended in 2012 (the PDPO), is the main legislation in Hong Kong which aims to protect the privacy of individuals in relation to personal data and to regulate the collection, holding, processing, or use of personal data based on a set of data protection principles (DPPs).

Pursuant to Art. 43 of the Law of the People's Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region (National Security Law), the Chief Executive may authorise the interception of communications or the covert surveillance of an individual if they think it is necessary and proportionate to the purpose for which such actions are sought. As a result, it is reported that the Law allows the government to request sensitive data if national security is deemed at risk, and that such authorisations are not legally reviewable. The National Security Law is implemented through the Implementation Rules for Art. 43 of the Law of the People’s Republic of China on Safeguarding National Security in the Hong Kong Special Administrative Region.

The Copyright Ordinance establishes a safe-harbour regime for intermediaries in relation to online copyright infringement. This regime was introduced by the Copyright (Amendment) Ordinance 2022, which inserted Division IIIA, which sets out limitations on the liability of service providers for infringements occurring through their services. Where the statutory conditions are satisfied, the safe harbour limits the remedies available against service providers, in particular by restricting monetary damages, and it is complemented by a statutory notice mechanism, including a notice-and-counter-notice procedure.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Hong Kong's law and jurisprudence. On 31 October 2019, the High Court handed down an interim injunction against the "promotion, encouragement and incitement of the use or threat of violence via Internet-based platform or medium". Subsequently, the High Court amended its injunction to restrain only those who willfully assist others in posting inciting material online. In other words, online service providers (OSPs) are not in breach of the injunction, even if they enable posts to be made on their platforms without knowing the facts or contents of such publications. Furthermore, the injunction does not impose a positive duty on OSPs to search for or filter out unlawful content uploaded by others.

The Telecommunications (Registration of SIM Cards) Regulation came into effect in September 2021 to implement the Real-name Registration Programme for Subscriber Identification Module (SIM) Cards. According to Art. 5 of the Regulation, telecommunications operators must not activate SIM cards unless users have registered their personal data, including their full name in English and Chinese, HKID number or other identity document number, a copy of their identity document and date of birth.

Hong Kong lacks a comprehensive framework for the protection of trade secrets. However, confidential information, including trade secrets, is protected by the common law of confidence, as well as by express and implied contract terms. While there is no single definition of a trade secret in Hong Kong, the characteristics of a trade secret were summarised in the 2003 case of AXA China Region Insurance Co Ltd v. Pacific Century Insurance Co Ltd, namely that a trade secret or its equivalent must be information which: is used in a trade or business; is confidential, i.e. is not already in the public domain; can be easily isolated from other information which an employee is free to use; if disclosed to a competitor, would be liable to cause real or significant harm to the owner; and is restricted from dissemination by the owner of the information. In the case of infringement, court orders may include (i) a declaration as to the confidentiality and the (lack of) entitlement to the use of the information; (ii) an injunction to restrain the use or further use of the confidential information; (iii) disclosure of any infringing use made of the information; and (iv) delivery of any infringing materials damages or, at the Plaintiff’s election, an account of profits.

There is no obligation for passive infrastructure sharing in Hong Kong to deliver telecom services to end users. However, it is practised in both the mobile and fixed sectors based on commercial agreements.

Hong Kong does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, it is reported that major fixed and mobile carriers are subject to accounting separation requirements to assist the Authority in monitoring developments in the telecommunications industry. Section 7A of the Telecommunications Ordinance (Cap. 106) empowers the Authority to attach special conditions to carrier licences, enabling it to impose and enforce service-level accounting separation requirements through licence conditions and related directions.
It is further reported that the Office of the Communications Authority (OFCA) requires dominant operators to maintain and report accounts disaggregated by service segment within their licensed operations, whereas non-dominant operators are required to maintain and report accounts only for their licensed operations as a whole.

Hong Kong has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

Hong Kong is a signatory of the World Trade Organization (WTO) Information Technology Agreement (ITA) of 1996 and its 2015 expansion (ITA II).

Hong Kong is a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), and its commitments also cover the services sectors considered most important for digital trade, namely telecommunication services (CPC 752), telecommunication-related services (CPC 754), and computer and related services (CPC 84).

Under the Communications Authority Ordinance and the Companies Ordinance, there are no ownership restrictions for telecommunications, the manufacture of information and communication technology goods and products, computer and related services, and online broadcasting. In addition, it is reported that there are no foreign ownership limitations in the telecom sector.