Home / News & Media / Latest News / Telecom Regulation in Hong Kong: An overview

Telecom Regulation in Hong Kong: An overview

18Oct2024

1. Legal and enforcement framework

1.1 Which legislative and regulatory provisions govern telecommunications in Hong Kong?

Telecommunications in Hong Kong is primarily governed by the following legislation:

  • the Communications Authority Ordinance (Cap 616);
  • the Telecommunications Ordinance (Cap 106);
  • the Competition Ordinance (Cap 619);
  • the Trade Descriptions Ordinance (Cap 362); and
  • the Unsolicited Electronic Messages Ordinance (Cap 593) (UEMO).

1.2 Which bodies are responsible for enforcing the applicable laws and regulations in the telecommunications sector? What powers do they have?

The Communications Authority is the independent regulatory body responsible for enforcing, overseeing and regulating the telecommunications and broadcasting sectors.

The Communications Authority shares concurrent jurisdiction with the Customs and Excise Department to enforce the fair trading provisions of the Trade Descriptions Ordinance (Cap 362) in the telecommunications and broadcasting sectors.

The Communications Authority also shares concurrent jurisdiction with the Competition Commission to enforce the Competition Ordinance (Cap 619) for the telecommunications and broadcasting sectors.

The Communications Authority operates through its executive arm, called the Office of the Communications Authority (OFCA).

The Communications Authority’s powers include the power to:

  • grant, renew, regulate and monitor telecommunications and broadcasting licences;
  • manage and administer the radio frequency spectrum and the telecommunications numbers;
  • develop technical standards and conduct equipment testing in line with international best practices; and
  • conduct examination and issuing certificates for the operating personnel of radiocommunications systems.

1.3 What is the general approach of those bodies in regulating the telecommunications sector?

According to OFCA, the Communications Authority “adopts a light-handed and pro-competition approach in the regulation of the telecommunications sector”.

1.4 What other industry codes of conduct or best practices are applicable in the telecommunications sector?

The Communications Authority issues codes of practice and guidelines in respect of telecommunications services. The guidelines of the Communications Authority are practical guidance and elaborations on provisions of legislation, and are not to be considered a complete or authoritative statement of the law or court practice.

2. Ownership

2.1 Who is eligible to provide services in the telecommunications sector in Hong Kong? Are there any restrictions on foreign ownership? Do any domicile requirements apply? What other requirements or restrictions apply in this regard?

Telecommunications services in Hong Kong are fully liberalised and are all provided by the private sector. There are no restrictions on foreign ownership of a telecommunications licence in Hong Kong. The only mandatory requirement is that a licence applicant be a company registered under the Companies Ordinance (Cap 622) in Hong Kong.

A company that wishes to apply for a telecommunications licence must apply to the Communications Authority for assessment. The Communications Authority will assess any telecommunications licence application based on various criteria, including:

  • whether the applicant and all persons exercising control of the applicant are fit and proper persons;
  • the scope of the proposed services;
  • the company structure;
  • the applicant’s financial soundness;
  • the applicant’s technical expertise; and
  • previous relevant experience.

3. Authorisations/licences

3.1 What authorisations and/or licences are required to operate in the telecommunications sector? Do any exemptions apply? Do these vary depending on the service to be provided?

The basic licensing requirement is that no person in Hong Kong can do any of the following without a licence:

  • establish or maintain any means of telecommunications;
  • offer in the course of business a telecommunications service;
  • possess or use any apparatus for radiocommunications or any apparatus of any kind that generates and emits radio waves;
  • deal in the course of trade or business in apparatus or material for radiocommunications or in any component part of any such apparatus or in apparatus of any kind that generates and emits radio waves; or
  • demonstrate, with a view to sale in the course of trade or business, any apparatus or material for radiocommunications.

The Communications Authority is the competent authority with the power to issue telecommunication licences, including:

  • carrier licences, including the unified carrier licence and space station carrier licence;
  • localised wireless broadband service licences;
  • wireless internet of things licences;
  • public radiocommunications service licences, including licences for public radio paging service operators, trunked mobile radio service operators, and railway signalling service operators;
  • services-based operator licences;
  • class licences; and
  • and other specific licences.

There are certain limited exemptions where a person that establishes or maintains a means of telecommunications does not need a telecommunications licence under the Telecommunications Ordinance (Cap 106). An example of a specific exemption would be in relation to a radiocommunications transmitting apparatus that is in air transit cargo or air transhipment cargo.

3.2 What are the key features of such authorisations/licences?

The key features of telecommunications licences are:

  • the period of validity;
  • the payment of fees and royalty; and
  • the frequency of payments.

For licences other than exclusive licences and carrier licences, the Communications Authority may determine:

  • the form of licence;
  • the conditions for grant of the licence;
  • the period for which the licence is valid;
  • the types of licence (including class licences) to be issued; and
  • the fees payable, including for the grant and renewal of licences and by way of annual fees.

The conditions of licences can include:

  • the manner of service provision;
  • interconnection;
  • interference;
  • adherence to technical standards;
  • compliance with directions, guidelines, codes of practice, regulations, the Telecommunications Ordinance (Cap 106) and international obligations;
  • universal service obligations;
  • accounting practices;
  • the provision of information;
  • tariffs;
  • network coordination;
  • the protection of customer information;
  • the prohibition of unfair market practice;
  • the regulation of a dominant licensee; and
  • the provision of performance bonds (Section 7 of the Telecommunications Ordinance (Cap 106)).

The Communications Authority has published sample licences for a number of licences, including:

  • the unified carrier licence;
  • the localised wireless broadband service licence; and
  • the localised wireless broadband service (private) licence.

3.3 What are the procedural and documentary requirements to obtain such authorisations/licences?

An applicant must complete all parts of the relevant application form in English and submit the application form with supporting documents to the Office of the Communications Authority (OFCA) to obtain a telecommunications licence.

The supporting documents to be submitted includes:

  • an application proposal setting out how the applicant meets the criteria to be granted a licence;
  • documents showing the company structure of the applicant; and
  • financial documents showing the applicant’s financial capability.

3.4 What does the authorisation/licensing process involve? How long does it typically take? What costs are incurred?

OFCA will review each application and the supporting documents and decide whether to grant a licence. Each application is evaluated on its merits having regard to the information provided as required in the relevant guidelines of the licence and to the broad licensing criteria under the Telecommunications Ordinance (Cap 106).

The length of time it takes to process each application depends on:

  • the type of telecommunication licence;
  • the quality of the submission; and
  • specific features of the application.

For example, OFCA has stated that it takes about three months to process a service-based operator licence application.

The costs incurred include the licence fee if the applicable licence is granted by the Communication Authority. Licence fees payable upon grant of the licence by the Communications Authority range from HK$150 to HK$100,000. Some licence fees increase according to the number of stations operating under the licence, or other variables.

3.5 What are the ongoing rights and obligations of the authorisation/licence holder? How is compliance monitored? What penalties may be imposed for breach?

The ongoing rights of a licence holder are that that the licence holder may conduct the activities set out in its licence for the validity period of the licence.

The ongoing obligations for each licence holder vary according to the specific licence in question. Common ongoing obligations include:

  • ensuring that all persons exercising control of the licence holder are fit and proper persons;
  • following conditions imposed under the licence to the satisfaction of the Communications Authority;
  • ensuring that its articles of association comply fully with the provisions of the Telecommunications Ordinance (Cap 106) and the terms and conditions of its licence;
  • operating, maintaining and providing a good, efficient and continuous service in a manner satisfactory to the Communications Authority;
  • supplying the Communications Authority with information upon request under the Telecommunications Ordinance (Cap 106); and
  • allowing the Communications Authority inspection rights of the premises or place of the licensee.

The Communications Authority will monitor holders of telecommunications licences to ensure that they are meeting their licence conditions and regulations. The Communications Authority has the power to investigate any suspected contravention of the licence conditions, codes of practice and the Telecommunications Ordinance (Cap 106). The public can also lodge a complaint or report to the Communications Authority in respect of a telecommunications licence holder. The Communications Authority publishes enforcement activity and consumer complaints on its website on at least a semi-annual basis.

Breaches of the Telecommunications Ordinance (Cap 106) may result in fines or imprisonment, depending on the breach. The Communications Authority also has the power to cancel, withdraw or suspend a telecommunications licence.

3.6 For how long is the authorisation/licence valid? Are variations to the terms possible? How is the authorisation/licence renewed?

Various telecommunications licences have different periods of validity. The validity of a licence is stated for the specified licence. A localised wireless broadband service licence may be valid for up to five years and a unified carrier licence may be valid for up to 15 years.

Variations to the terms of a telecommunication licence are possible. The licensee may apply to the Communications Authority to change its scope of service, for example. The Communications Authority may act on its own volition to vary the terms of a licence, but any such variation will require the consent of the licensee.

There are special rules for variations in respect of class licences. The Communications Authority may vary a class licence by:

  • providing notice in the Government Gazette to allow for representations from the public; and
  • proceeding with the variation having duly considered the representations it has received.

Each telecommunications licence has different provisions and processes for renewal. For example, a carrier licence does not automatically renew and a licence holder must apply for a new licence before expiry. A services-based operator licence can be renewed for two years at a time, and there is a specific procedure to do this.

3.7 Can an authorisation/licence be transferred? If so, what is the process for doing so?

Subject to the terms of the specific licence, a licensee may generally transfer its licence only:

  • with the prior written consent of the Communications Authority; and
  • subject to such reasonable conditions as the Communications Authority thinks fit.

The licence holder must apply to the Communications Authority in writing.

4. Telecommunications

4.1 What provisions apply to the construction of telecommunications infrastructure and the installation of facilities on public and private property?

The Communications Authority and its authorised licensees may place and maintain a telecommunications line and such posts as may be necessary in, over or upon any land or seabed. The Communications Authority and its authorised licensees may also enter any land or the seabed for the purpose of site inspection or other activities relating to placement and maintenance of a telecommunications line.

The Communications Authority needs:

  • the written consent of the director of lands to exercise these rights in the case of unleased government land or seabed; and
  • the written consent of the commander of the relevant garrison in the case of land vested in or occupied by a garrison (Section 14 of the Telecommunications Ordinance (Cap 106)).

Land, for the purpose of these rights, excludes land for the exclusive occupation or use of any person while it is being so occupied or used.

4.2 Do any universal service obligations apply in Hong Kong? If so, what are they and how are they funded?

Universal service obligations (USO) do apply in Hong Kong (Section 35B of the Telecommunications Ordinance (Cap 106)). Presently, PCCW-HKT Telephone Limited and Hong Kong Telecommunications Limited has a USO condition stated under its carrier licence. This specifies that basic services should be made reasonably available to all persons in Hong Kong at service charges capped by the published tariffs.

The USO mainly covers basic fixed voice telephony services and public payphones. The cost of providing a public payphone service subject to the USO is shared by fixed and mobile services operators. A review of public payphones was conducted by the Office of the Communications Authority (OFCA) in 2019 resulted in 515 in-building public payphone (35% of the total) and 765 kiosk public payphones (50% of the total) being excluded from the USO. This reduced the overall cost burden of the USO and increased price competitiveness in the market.

The Communications Authority has established a system for licensees to make reasonable contributions to a fund managed by the Communications Authority to fund the cost of providing the USO.

Broadband or mobile services are not covered under the USO and the coverage of such services is mainly a commercial decision.

4.3 How is interconnection regulated in Hong Kong? What rules and requirements apply in this regard? Are interconnection and network access charges subject to price regulation?

Interconnection is regulated under the Telecommunications Ordinance (Cap 106). Telecommunications carriers must interconnect their services and networks to ensure any-to-any connectivity.

The Communications Authority may determine any application of interconnection and the terms and conditions of interconnection between telecommunications networks and services. The requirements will be set out in the specific licence. The Communications Authority may also issue directions to a licensee requiring it to take such action as the Communications Authority considers necessary to secure the connection of any telecommunications service to another telecommunications network or system. Notwithstanding these powers, the policy of the Communications Authority is to encourage that interconnection agreements are commercially negotiated.

The Communication Authority may determine the level of, and the method of calculating, the charges that any party will pay to another. The charges will be based on the relevant reasonable costs attributable to interconnection. The Communications Authority does not directly regulate charges, as it pursues a policy that charges should be determined through commercial negotiations between licensees.

There is a general obligation on parties to an interconnection agreement to file a copy of the agreement with the Communications Authority within 14 days of it being made. This obligation may be waived by the Communications Authority, which has indeed issued waivers to relax the filing requirement. At present, the filing requirement applies only to interconnection agreements signed between carrier licensees which are of a type or contain a substantive element that is new to one or more of the parties.

4.4 What rules and requirements govern the allocation and use of telephone numbers in Hong Kong?

The Communications Authority governs the allocation and use of telecommunication numbers and codes, and retains all rights, ownership and control over them. The Communications Authority has issued a Numbering Plan for Telecommunications Services in Hong Kong. A licensee may apply to the Communications Authority for the allocation of telecommunication numbers and codes under the numbering plan.

4.5 What rules and requirements govern number portability in Hong Kong?

Licensees for the provision of fixed or mobile services must facilitate mobile number portability among their networks. Number portability for fixed and mobile telecommunications services is implemented in Hong Kong using the distributed database approach.

Under the Telecommunications Ordinance, the Communications Authority (Cap 106) has issued the following requirements and codes of practice setting out the rules and requirements that govern number portability:

  • the Requirements for Mobile Number Portability by Database Solution (HKCA 2103);
  • the Functional Specification of Administration Database for Mobile Number Portability (HKCA 2104);
  • the Code of Practice Related to the Implementation of Mobile Number Portability; and
  • the Code of Practice Relating to the Use of Numbers and Codes in the Hong Kong Numbering Plan.

4.6 Are retail customer charges subject to price regulation in Hong Kong?

The Secretary for Commerce and Economic Development, being the designated government official for telecommunications, may require that:

  • a fixed carrier licensee which is in a dominant position in a telecommunications market be subject to price control measures; and
  • a carrier licensee which is in a dominant position in the telecommunications market be prohibited from charging more or less than its published tariffs (Section 7G of the Telecommunications Ordinance (Cap 106)).

Otherwise, the policy of the Communications Authority is to promote competition and for licensees to set customer charges on a normal commercial basis.

4.7 Are retail customer terms and conditions subject to regulation in Hong Kong?

Retail customer terms and conditions are subject to regulation in Hong Kong by the Telecommunications Ordinance (Cap 106) and the codes of practices issued by the Communications Authority.

The Communications Association of Hong Kong has issued an Industry Code of Practice for Telecommunications Service Contracts. The Communications Association of Hong Kong is a trade association for Hong Kong’s communications industries. The Industry Code has been effective since 1 May 2015 and applies to personal or residential users.

The Industry Code sets minimum standards of practice in respect of customer terms and conditions, and addresses topics such as:

  • clarity of terms in contracts;
  • the provision of written confirmation for contracts concluded over the phone;
  • an opt-out option for free-trial services;
  • a cooling-off period for contracts entered into during unsolicited visits to consumers’ homes;
  • procedures for service contract renewal and termination;
  • protection of customers from unilateral variation of contract terms; and
  • fair arrangements for service relocation requests.

Although the Industry Code is a voluntary scheme, it has been endorsed by OFCA and licensees are expected to comply with it. Licensees may choose to include other customer terms and conditions which are not inconsistent with the Industry Code.

The Communications Authority will also regulate any exploitative or anti-competitive behaviour of licensees.

5. Spectrum use

5.1 How is spectrum use authorised in Hong Kong? Do any exemptions apply?

The Communications Authority is responsible for promoting and managing the efficient allocation and use of radio spectrum as a public resource of Hong Kong. It has the power to allocate frequencies (and bands of frequencies) for all parts of the radio spectrum used in Hong Kong and to designate the spectrum utilisation fee (SUF) (Part 5B of the Telecommunications Ordinance (Cap 106)).

The guiding principle adopted by the Communications Authority is to apply a market-based approach in spectrum management when there are competing demands from providers of non-government services. Key policy objectives include:

  • facilitating the most economically and socially efficient use of spectrum with a view to attaining maximum benefit for the community; and
  • achieving technically efficient use of spectrum to facilitate the introduction of advanced and innovative communications services and strengthen Hong Kong’s position as a telecommunications and broadcasting hub.

There are parts of the spectrum that are reserved for use by the government and parts that are managed by the government administration.

5.2 What is the procedure for allocating spectrum in Hong Kong?

The Communications Authority publishes a Spectrum Release Plan, which is updated each year. The plan is intended to notify interested persons of the potential supply of radio spectrum available for open bidding, tendering or other appropriate means over the next few years (usually three years). An interested party may bid or apply to the Communications Authority for the available radio spectrum. The Communications Authority will then allocate the radio spectrum in accordance with the auction, tendering or other applicable means made by the interested parties. Spectrum allocation is usually for a period of 15 years.

5.3 How long does it typically take? What costs are involved?

The time to allocate spectrum will depend on the auction, tender or other means chosen by the Communications Authority.

The Communications Authority will determine the spectrum and services that will attract SUF and the levels of SUF payable. The following laws give effect to the SUF charging scheme governed by the Communications Authority:

  • the Telecommunications (Designation of Frequency Bands Subject to Payment of Spectrum Utilisation Fee) Order (Cap 106Y); and
  • the Telecommunications (Level of Spectrum Utilisation Fee) (Fixed and Other Links) Regulation (Cap 106AE).

5.4 What are the penalties for unauthorised spectrum use or breach of authorisation?

A person must not, in Hong Kong or on board any ship, aircraft or space object that is registered or licensed in Hong Kong, use a frequency in any part of the radio spectrum unless the frequency is assigned or located within a band of frequencies assigned by the Communications Authority.

It is an offence if a person uses an apparatus for telecommunications in a manner that causes direct or indirect harmful interference with any telecommunications service lawfully carried on, or other apparatus for telecommunications lawfully operated, in or outside Hong Kong. Upon conviction, an offence may result in a potential fine of HK$50,000 and imprisonment for six months.

A licensee that possesses or uses a radio transmitter operating on another frequency that is not authorised under its licence will commit an offence under the Telecommunications Ordinance (Cap 106) and will be liable on conviction to a fine of HK$50,000 and to imprisonment for two years.

5.5 Can a spectrum authorisation be transferred? If so, what is the process for doing so?

Spectrum trading is a mechanism whereby a spectrum assignee may transfer all or part of the spectrum it holds to another party for the duration of spectrum assignment. Spectrum trading is not permitted in Hong Kong. In a 2018 policy statement of the Commerce and Economic Development Bureau, following a feasibility study, the policy was confirmed that there was no justifiable case for introducing spectrum trading in Hong Kong in the short or medium term.

6. Competition

6.1 What competition-related provisions (e.g., structural or functional separation requirements; significant market power requirements; media plurality rules) apply in the telecommunications sector?

The Competition Ordinance (Cap 619) governs the competition-related provisions relevant for the telecommunications sector.

The Competition Ordinance (Cap 619) prohibits anti-competitive conduct under the first conduct rule, the second conduct rule and the merger rule. The first conduct rule prohibits anti-competitive agreements, concerted practices and decisions. The second conduct rule prohibits the abuse of market power.

The merger rule prohibits mergers that would substantially lessen competition. The merger rule applies only if one or more of the participants in the merger (eg, the acquirer or the entity being acquired):

  • holds a carrier licence;
  • indirectly or directly controls a carrier licence holder; or
  • conducted business immediately before the acquisition under a carrier licence under the Telecommunications Ordinance (Cap 106).

Also, the Communications Authority has the power to regulate a licensee in a dominant position in the telecommunications market, including regulating conduct that it considers exploitative. ‘Exploitative conduct’ includes:

  • fixing and maintaining prices or charges at an excessively high level; and
  • setting unfair trading terms and conditions for the provision on interconnection arrangements.

The Communications Authority has published guidelines to assist licensees in complying with the relevant competition provisions.

6.2 To what extent can the national competition regulator intervene in the telecommunications sector?  What is the interplay between the competition regulator and the various sectoral regulators?

Under the Competition Ordinance (Cap 619), the Communications Authority is to enforce the Competition Ordinance (Cap 619) in respect of the conduct of undertakings operating in the telecommunications sectors. Specifically, the Communications Authority may perform the functions of the Competition Commission under the Competition Ordinance (Cap 619) insofar as they relate to the Telecommunications Ordinance (Cap 106).

The Communications Authority and the Competition Commission have signed a memorandum of understanding to coordinate the performance of their functions on which they have concurrent jurisdiction. Competition cases will be handled by the two authorities according to the arrangements set out in the memorandum of understanding.

If the matter falls within the scope of concurrent jurisdiction, the initiating authority will inform the other and determine which will be the lead authority. For cases involving the telecommunications sector and falling within the concurrent jurisdiction, the Communications Authority will ordinarily take the role of the lead authority and will assume responsibility for exercising the relevant powers and functions conferred upon it under the Competition Ordinance (Cap 619). The other competent authority will play a supporting role in such a manner as is appropriate or agreed, including by providing staffing support to assist the other side to the extent that resourcing allows.

If, at any point, it is not appropriate for the lead authority to continue considering a matter, the lead authority may refer the matter to the other competent authority.

6.3 How are mergers and acquisitions in the telecommunications sector treated from a competition perspective?

The Competition Ordinance (Cap 619) prohibits mergers that substantially lessen competition in Hong Kong. This is referred to as the ‘merger rule’. A merger will typically arise from:

  • an amalgamation of undertakings;
  • an acquisition of control; or
  • an acquisition of assets.

The merger rule is not breached if there is likely to be no material reduction in competition.

The merger rule applies only if one or more of the participants in the merger (eg, the acquirer or the entity being acquired):

  • holds a carrier licence;
  • indirectly or directly controls a carrier licence holder; or
  • conducted business immediately before the merger under a carrier licence under the Telecommunications Ordinance (Cap 106).

If the lead authority believes that the merger rule is relevant to a transaction, it will conduct an assessment of the competitive effects of the merger transaction. This will entail an assessment of whether the transaction has, or is likely to have, the effect of substantially lessening competition in an identified market.

The merger rule does not apply to a merger if the economic efficiencies that arise or may arise from the merger transaction outweigh the adverse effects caused by any lessening of competition in Hong Kong.

There is no requirement to notify either the Communications Authority or the Competition Commission of a merger falling within the merger rule. Recommended best practice is for parties to a merger transaction which is likely to fall within the merger rule to notify the competent authority at the earliest opportunity and seek informal advice.

The lead authority may accept a commitment from parties to a merger transaction in respect of conduct that the lead authority considers appropriate to address its concerns about a possible contravention of the merger rule (eg, the 2019 acquisition of WTT Holding Corp by HKBN Ltd), in return for the lead authority’s agreement not to commence an investigation or bring proceedings in the Competition Tribunal, or to terminate any investigation or proceedings that have been commenced.

Before accepting a commitment, the lead authority must:

  • give notice of the proposed commitment to those that are considered likely to be affected by the merger;
  • allow at least a period of 15 days for representations to be submitted; and
  • consider any representations that are made.

Any commitment accepted by the lead authority will be made public by the lead authority.

The parties to a merger transaction can also apply for a formal decision that the transaction is excluded from the scope of the merger rule.

Ultimately, if the lead authority, after carrying out an investigation, has reasonable cause to believe that a merger or an anticipated merger contravenes, or is likely to contravene the merger rule, it may bring proceedings before the Competition Tribunal seeking orders to stop the contravention. This will have the practical effect of stopping or unwinding the merger transaction.

6.4 What other specific challenges or concerns do the telecommunications sector present from a competition perspective?

In general, there are few specific challenges or concerns from a competition perspective in respect of the telecommunications sector. All sectors of Hong Kong’s telecommunications market have been liberalised, with no foreign ownership restrictions on telecommunications operators. The Communication Authority adopts policies to maintain a level playing field in an open and competitive telecommunications market.

Taking each of the key elements of the telecommunications sector in turn, the trends noted in the 2021 Annual Report of the Communications Authority include the following:

  • Mobile communication services: As at March 2022, there were four major mobile network operators, providing a wide range of public mobile services in a market that the Communications Authority has described as keenly competitive.
  • Fixed communication services: The local fixed communications services market has been fully liberalised, with no pre-set limit on the number of licences to be issued for fixed services or deadline for the submission of licence applications. There is no specific requirement on network rollout and investment, and licensees may provide their services according to their proposals. As at March 2021, there were 27 local fixed carriers.
  • Fixed broadband services: As at March 2021, 27 facility-based operators and 237 service-based operators were authorised to provide broadband internet access services in Hong Kong.
  • Internet of Things services: Three wireless Internet of Things licences have been issued since the introduction of that licence in December 2017.
  • Public WiFi services: As at March 2021, eight network operators and 183 class licensees were providing public WiFi services in various locations in Hong Kong.
  • External telecommunications services: The external telecommunications facilities market has been fully liberalised in Hong Kong. As at March 2021, 42 fixed carriers were authorised to provide cable-based or non-cable-based external telecommunications facilities. There were eight cable landing stations in Hong Kong, and Hong Kong was connected to 11 regional and transcontinental submarine cable systems.
  • Satellite services: Hong Kong has adopted an ‘open sk’ policy in regulating the provision of satellite services. Licences are required for the operation of satellites and associated facilities. As at March 2021, two Hong Kong companies were licensed to operate satellites for providing communications services, operating a total of 10 in-orbit satellites.

7. Data security and cybersecurity

7.1 What data security regimes apply in the telecommunications sector?

The main legislative regime with provisions relating to data security is the Personal Data (Privacy) Ordinance (Cap 486) (PDPO).

Telecommunications providers are likely to be considered data users under the PDPO, and are subject to the obligations and requirements set out in the PDPO. A ‘data user’ means a person that, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of personal data.

The PDPO sets out six data protection principles (DPPs):

  • DPP1: Personal data must be collected in a lawful and fair manner, and the data user must give specified information to a data subject when collecting his or her personal data.
  • DPP2: Personal data must be accurate and up to date, and kept for no longer than necessary.
  • DPP3: Personal data should only be used for the purposes for which it was collected or a directly related purpose. Otherwise, the data user must obtain the ‘prescribed consent’ of the data subject.
  • DPP4: The data user must have measures in place to ensure the confidentiality and security of personal data.
  • DPP5: Data users must provide general information about the kinds of personal data they hold and the main purposes for which personal data is used.
  • DPP6: Data subjects must be given a right to access their personal data and a right to correct it.

DPP4 is the most relevant in respect of data security and requires data users take all practical steps to protect the personal data they hold against unauthorised and accidental access, processing, erasure, loss or use. Data users must have particular regard to:

  • the nature of the data;
  • the potential harm if such events were to happen; and
  • measures to ensure the integrity, prudence and competence of persons with access to the data.

If personal data is entrusted by the data user to a data processor, the data user is liable as the principal for any act done by its authorised data processor. The data user must adopt contractual or other means to prevent:

  • any personal data transferred to the data processor from being kept for longer than necessary for processing the data; and
  • unauthorised or accidental access, processing, erasure, loss or other inappropriate use of the personal data.

The PCPD has published a guidance note for mobile service operators in respect of personal data concerns. The guidance covers recommended best practices in:

  • handling mobile phone service applications;
  • audio-recording customer conversations;
  • maintaining customer service accounts;
  • disclosing customer account data;
  • protecting service account data; and
  • engaging third-party agents and dealers.

Also, telecommunications operators that are licensees are prohibited from disclosing information about a customer, except with the consent of the customer in accordance with a prescribed form designated by the Communications Authority, except:

  • for the prevention or detection of crime;
  • for the apprehension or prosecution of offenders; or
  • as may be authorised by or under any law.

7.2 What cybersecurity regimes apply in the telecommunications sector?

Hong Kong does not have a single overarching cybersecurity law, though this will in the coming months with the coming into law of the Protection of Critical Infrastructure (Computer System) Bill. The communications and broadcasting sectors are designated as essential services under the Bill, and the Communications Authority will be designated authority to monitor ongoing obligations of those sectors with the planned statutory requirements.

Currently, offences relating to cybersecurity are contained in various laws.

Telecommunications Ordinance (Cap 106): The Telecommunications Ordinance (Cap 106) criminalises actions involving:

  • damage to telecommunications infrastructure with intent;
  • unauthorised access to computers by telecommunications; and
  • transmission of false or deceptive distress messages.

Crimes Ordinance (Cap 200): The Crimes Ordinance (Cap 200) criminalises access to a computer with criminal or dishonest intent.

PDPO: The PDPO provides for offences for the disclosure of personal data without consent, among other things.

Unsolicited Electronic Messages Ordinance (Cap 593): This criminalises the initiation of transmissions of multiple commercial electronic messages from telecommunications devices that are accessed without authorisation and with the intent to deceive or mislead recipients as to the source of the messages.

Interception of Communications and Surveillance Ordinance (Cap 589): Subject to limited exceptions, it is unlawful for a public officer to carry out intercepting acts relating to communications. ‘Intercepting acts’ involve the inspection of some or all of the contents of the communication, in the course of its transmission by a postal service or by a telecommunications system, by a person other than its sender or intended recipient. One relevant exemption is that the prohibition does not apply to any interception of telecommunications transmitted by radiocommunications (other than the radiocommunications part of a telecommunications network for the provision of a public telecommunications service by any carrier licensee under the Telecommunications Ordinance (Cap 106)).

Enforcement: There is no single authority responsible for enforcing cybersecurity laws in Hong Kong. Rather, the competent enforcement authority will depend on the nature of the offence in question.

The Hong Kong Police Force is the enforcement authority for crime in Hong Kong. The Cybersecurity and Technology Crime Bureau is responsible for:

  • handling cybersecurity issues;
  • carrying out technology crime investigations and computer forensic examinations; and
  • preventing technology crime.

The PCPD is the competent authority for regulation of personal data matters, and will conduct investigations and issue enforcement notices.

The commissioner on interception of communications and surveillance is responsible for overseeing compliance by law enforcement agencies and their officers with the relevant requirements under the ICSO.

Policy: At a policy level, information security and cybersecurity fall under the remit of the Office of the Government Chief Officer (OGCIO). Its work involves the following:

  • The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) is the centralised contact on computer and network security incident reporting and response for local businesses and internet users in case of security incidents.
  • The Cybersec Infohub is a partnership programme to promote closer collaboration among local information security stakeholders in different sectors to share cybersecurity information and jointly defend against cyberattacks. It is not intended for cybersecurity incident reporting, which is the role of HKCERT.
  • The OGCIO has established an information security website portal to facilitate the public’s access to various information security-related resources and updates.

7.3 What other specific challenges or concerns do the telecommunications sector present from a data security/cybersecurity perspective?

Operators in the telecommunications sector must consider requests from enforcement authorities to obtain access to communications, and this can be an area of concern or challenge.

In general, the Hong Kong police do not have the authority to conduct indiscriminate surveillance or search or seizure of data without prior authorisation.

Search and seizure with warrant: A warrant overrides any right to refuse disclosure on the basis of the PDPO and any contractual confidentiality obligations owed to third parties. However, there is no obligation to provide or disclose information or material that is subject to legal professional privilege.

Persons that fail to cooperate with enforcement authorities without a reasonable excuse commit an offence and may be criminally liable and arrested for obstructing the police in the execution of their lawful duties. Also, a number of offences are committed for failing to comply with court orders to provide access to information or prejudicing investigations.

Search and seizure without warrant: Warrants must generally be granted by the judiciary before police officers can carry out search and seizures at a specific site. However, in certain situations, a senior police officer may also authorise officers to carry out a search without a warrant or perform covert surveillance operations in circumstances where it is not reasonably practicable to obtain authorisation.

Covert interception of communication: The Hong Kong police may intercept communications or conduct covert surveillance upon obtaining authorisation from:

  • a designated authorising officer, for less intrusive covert surveillance operations; or
  • a panel judge, for more intrusive covert surveillance operations

The purpose of the operation must be confined to the prevention or detection of serious crimes or the protection of public security. In addition, the tests of proportionality and necessity must be met, including the requirement that the purpose of the operation cannot reasonably be fulfilled by other less intrusive means. Any application for authorisation must state a specific serious crime or threat to public security.

The National Security Law provides similar legislative power for the Hong Kong police to carry out covert interception of communication or surveillance. The application procedure and the criteria required are largely identical to those of the ICSO, except:

  • an application under the National Security Law must relate to an offence of endangering national security; and
  • applications made under the National Security Law are generally made to the chief executive or the commissioner of police in emergency situations (rather than a panel judge).

Disclosure of personal data: Exemptions are specified in the PDPO in which data users can disregard certain provisions. Data users may disclose personal data to law enforcement agencies, such as the Hong Kong police, if the use of personal data by the law enforcement agencies is for:

  • the prevention or detection of crime; or
  • the apprehension, prosecution or detention of offenders.

However, simply because a law enforcement agency requests personal data does not mean that data users can provide the data requested without complying with DPP3 (which relates to the use of personal data for a new purpose).

Data users must consider whether non-provision of the data would be so serious as to be likely to prejudice the purposes for which it is collected. The view taken by the PCPD is that it is prudent for data users to make enquiries with the law enforcement agency on:

  • the purpose for which the personal data is collected;
  • the reasons why the personal data concerned is relevant; and
  • the reasons why the data subject’s consent should not be obtained by the enforcement agency.

8. Trends and predictions

What are the legislative trends and developments in Hong Kong for the telecommunications sector?

Trends:

  • Ongoing implementation of real-name registration of SIM cards: As from 1 March 2022, all SIM cards issued by telecommunications operators of Hong Kong to be used for local person-to-person communications must have real-name registration before activation. The programme addresses issues arising from the anonymous nature of SIM cards and is intended to assist law enforcement agencies in the detection of crimes involving the use of SIM cards.
  • 5G implementation: The most significant trend in the TMT industry landscape in Hong Kong is the increasing development and use of the 5G spectrum. In total, 1,730 MHz of new spectrum has been supplied to the industry which is equivalent to almost three times of the spectrum previously released for the provision of 2G, 3G and 4G services.

Developments: We foresee two possible significant developments in the next 12 months, both in the cybersecurity area:

  • Cybersecurity: The Protection of Critical Infrastructure (Computer System) Bill will likely be considered and passed by the Legislative Council within 2024. The Commissioner’s Office proposed under the legislation will be established within the Security Bureau within one year from passing of the legislation, and the legislation will come into force six months after.
  • New cybercrime offences: On 20 July 2022, the Cybercrime Sub-committee of the Hong Kong Law Reform Commission published a consultation paper with its recommendations to introduce five new cybercrimes into law in Hong Kong. The proposed new cybercrime offences are:
  • illegally accessing a computer program or data;
    • illegally intercepting computer data;
    • illegally interfering with computer data;
    • illegally interfering with a computer system; and
    • making available or possessing a device or data for committing a crime.

The Law Reform Commission has also recommended that the nature of cybercrime justifies the extra-territorial application of Hong Kong law. Legislative change may follow once the consultation conclusions are considered by the Department of Justice.

9. Tips and traps

What are your top tips for new entrants seeking to operate in the telecommunications sector in Hong Kong?

The telecommunications market is fully liberalised in Hong Kong and there are no foreign ownership restrictions. The Communications Authority adopts a light-handed and pro-competition approach in the regulation of the telecommunications sector. Compared to many jurisdictions, Hong Kong is an open jurisdiction for market entry.

Pádraig Walsh and Tara Chan

If you want to know more about the content of this article, please contact:

Pádraig Walsh

Partner | Email

Disclaimer: This publication is general in nature and is not intended to constitute legal advice. You should seek professional advice before taking any action in relation to the matters dealt with in this publication. This article was last updated on 18 October 2024.

Padraig Walsh, Data Privacy, Latest News, News & Media, Legal Updates