An Empirical Study on Personal Data Protection in the Banking Sector across Hong Kong, Macau, and Mainland China

Abstract This study examines the personal data protection practices within the banking sectors in the Greater Bay Area—Hong Kong, Macau, and Mainland China. Our analysis reveals significant inconsistencies in the application of related privacy policies of banks across the three regions, with specific focus on aspects such as personal and sensitive data, data processing, and the protection of minors’ personal data. The discrepancies stem from diverse regional laws, regulations, and judicial practices that generate legal uncertainties, subsequently impacting cross-border data transfer. The study emphasizes an urgent need for a harmonized approach to data protection within the Greater Bay Area and highlights practical challenges encountered in harmonizing the relevant laws across the three regions. It recommends developing data protection standards for the banking industry and using such standards as useful guidelines for addressing the existing discrepancies in data protection regulations and practices. This could ensure consistency, allow for daily banking operations that comply with the diverse data protection rules across the three regions, and foster data flow within the banking sector in the Greater Bay Area.