How Hong Kong mall owners can stay abreast of China’s personal data protection law

China’s Personal Information Protection Law is an opportunity for Hong Kong retailers to strengthen their personalised advertising and marketing strategies
With cross-border travel yet to resume, the city’s retailers can tweak their privacy policies and app-based loyalty programmes to comply with the law

Elyse Leung

Published: 12:01pm, 26 Jul 2022

Why you can trust SCMP

China is taking an active approach to protect its citizens’ personal data, with the country’s first comprehensive personal data privacy law.

The Personal Information Protection Law (PIPL), enacted last November, joins the Data Security Law and Cybersecurity Law in framing the legal landscape for data protection, establishing consumer consent as the legal basis for personal information processing in the country.

The law applies to all marketing campaigns that provide products and services to or analyse the activities of people from mainland China, and does not discern the location of brands and marketers. This means mall owners located outside the mainland, including those in Hong Kong, are affected by the PIPL.

Millions of mainland Chinese consumers who visited Hong Kong previously are likely to have left their personal information with their favourite shopping malls’ websites or apps. In 2019, same-day mainland Chinese visitors spent a total of HK$60.4 billion (US$7.7 billion), with 86.6 per cent allotted to shopping, according to data from Hong Kong Tourism Board.

Mainland Chinese visitors wait outside a luxury store at a shopping district in Hong Kong in this file photo from March 19, 2015. Photo: Reuters

In light of the PIPL, mall owners may wonder if and how they can continue to market to these customers. Unable to separate existing customer data based on location, they may worry about inadvertently breaching the PIPL’s requirements when carrying out their marketing activities.

To address these concerns, mall owners should re-examine the privacy policies of their site or app-based loyalty programmes with the PIPL in mind, to ensure that appropriate consumer consents are obtained.

Under the PIPL, the processing of personal information can only move forward upon receiving the voluntary consent of a fully informed consumer. Consent must also be obtained again if the original purpose for which it was granted changes.

Former Hong Kong privacy chief says PIPL will challenge city’s firms

Personal information to be shared with a third party data collector, or transmitted from mainland China to Hong Kong, requires a separate consent. Mall owners should ensure their customer base is informed of the purpose for which their personal information is to be used, and make consumers aware of their ability to exercise the right to withdraw their consent.

Once appropriate consent procedures are in place, mall owners and developers can continue to carry out personalised promotional activities targeted at mainland Chinese consumers, including the use of app-based loyalty programmes to collect and process personal information.

China premier stresses data security after alleged leak affecting 1 billion Chinese residents triggers concerns

Another solution is establishing geography- or location-based promotional marketing methods, which can be set up within loyalty programme mobile apps to ensure that notifications and relevant promotional activities are pushed on consumers only when they are in Hong Kong, and turned off once they return to the mainland.

Mall owners may also consider incorporating non-personal information based solutions in their marketing strategies, such as ID Space solutions. Collaborating with different brands to obtain appropriate consents can result in anonymised information, such as important cohort interest data. These solutions address the trend in the diminishing usage of personal information by empowering advertisers to reach their target consumers without the use of unique identifiers.

07:30

Why China is tightening control over cybersecurity

Further stipulations of the law are still being hashed out, which means there is ample time to prepare for the PIPL before Hong Kong-mainland travel resumes. Mall owners should continue to stay abreast of new regulations and rules stemming from the PIPL, such as those related to the transfer of personal information outside the mainland, which may necessitate procedures in addition to receiving separate consents.

Given Hong Kong’s importance to the development of the Greater Bay Area economy, special consideration may be given in the future to cross-border data transfers from mainland China to Hong Kong. If implemented, such mechanisms would greatly cement the connection between Hong Kong and consumers from mainland China, providing mall owners and developers in Hong Kong with significant advantages.

While its broadly defined conditions can be a cause for concern, the PIPL serves as an opportunity for key retailers to fortify their personalised advertising and retargeting marketing strategies.

Mall owners should focus on curating their data collection strategies and developing innovative marketing campaigns and loyalty programmes. Those who make a concerted effort to comply with the PIPL’s requirements and who are transparent in their requests for consent will be able to earn consumers’ trust, building a community of customers who are digitally conscious and willing to share their first-party data.

Elyse Leung is the vice-president of Hong Kong and Macau at AI marketing technology platform EternityX

Post