Given the growing number of mainland citizens traveling to Hong Kong to purchase insurance policies, in 2018 (and no doubt inspired by the “Stock Connect (2014)” and “Bond Connect (2017)” schemes which allowed investors on either side of the border to invest in shares and bonds respectively), the IA suggested that Hong Kong insurance firms should be allowed to set up service centers in the Greater Bay Area1 through an “Insurance Connect” scheme to provide after-sales services. In his speech at the “Guangdong-Hong Kong-Macao Greater Bay Area Summit Forum 2018,” Dr. Moses Cheng, Chairman of the IA, emphasized that Hong Kong and mainland policy holders should be able to enjoy broader insurance coverage and streamlined insurance services under “Insurance Connect”.2
Although to date, little has been made publicly available in respect of the specifics of “Insurance Connect”, some commentators expect that in the initial phase, Hong Kong insurers will be allowed to set up logistics centers in mainland cities in the Greater Bay Area, where policy holders can pay renewal premiums, make claims and receive other after-sales services. The second phase of “Insurance Connect” would enable cross-border sales of insurance products within the Greater Bay Area.3
“Insurance Connect” will no doubt expand business opportunities for Hong Kong insurers, but we believe it will also pose certain challenges. One of the major challenges will be the sharing and transferring of personal data in relation to insurance policy holders as between Hong Kong and mainland China, given that Hong Kong and mainland China have different data protection frameworks. To give one example, there is currently no prohibition under the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) on transfer of personal data to places outside Hong Kong, as section 33 of the PDPO which restricts such transfers is not yet in force. Similarly, the Cyberspace Administration of China published a draft Cross-Border Personal Information on Transfer Security Assessment Measures in June 2019 (“Draft Cross-border PI Transfer Rules”), which stipulated that “before any personal information is exported from the PRC, network operators must report to the local provincial-level network information department for a security assessment with respect to a cross-border transfer of personal information.” These rules are not in force either.
To date, no concrete timetable has been given indicating when these provisions under the PDPO and the Draft Cross-Border PI Transfer Rules will come in force. The Draft Cross-Border PI Transfer Rules, with its default position of a security review, has proven to be particularly controversial due to its potential impact on foreign-owned businesses in China that rely on frequent cross-border transfers of personal information. Insurers who wish to participate in “Insurance Connect” will need to give consideration to how a Greater Bay Area Insurance Connect operation would function if such provisions came into effect (it being a possibility that the authorities could bring the legislation into force as a coordinated effort or independently at different times). This is particularly the case on the China-Hong Kong leg, where (assuming no change in the final legislation) repatriation of personal data from mainland China logistics centers could be delayed or even blocked due to a security review. A possible solution would be to pre-emptively put in place an agreement as required to be submitted under the Draft Cross-border PI Transfer Rules, so that they are ready to meet the requirements if and when they become law.
References
-
In 2020, the Greater Bay Area has a combined population of over 86 million people and GDP of around US$1,671.7 billion.
-
-
Authored by Mark Lin, Andrew McGinty, and Sherry Xiao.
