What growing cross-border data flows mean for data centres

A recent memorandum between Hong Kong's Innovation, Technology and Industry Bureau (ITIB) and the Cyberspace Administration of China (CAC), where both parties agreed to draft rules on improving data flows between Mainland areas of the Greater Bay Area (GBA) and Hong Kong, has been met with mixed sentiments from data centre operators.

In principle, these upcoming rules could allow access for data centres in Hong Kong to process data transferred from Mainland locations in the GBA, which has a population of nearly 90 million across Hong Kong, Macau, and nine municipalities in China’s Guangdong province.

But not all data centre players are convinced by the proposed change that comes just two years after the People's Republic of China (PRC) passed a sweeping data privacy law restricting how companies collect, use, and manage personal data.

There’s still a “fear factor” among international and local data centre operators in Hong Kong regarding access by PRC authorities to data, says Timmy Fung, Senior Director, Data Centre Capital Markets, Greater China, JLL.

How this pans out will largely depend on the drafting of the rules, which is anticipated to take months to complete.

From a legal standpoint, however, the concerns over data access and governance appear to be unfounded. The ITIB has reassured Hong Kong residents not to worry about privacy invasion as personal information is protected under strict laws.

“One of the aims of the proposed rules is to facilitate data flowing from Mainland locations in the GBA to Hong Kong, presumably to address current legal restrictions on transferring certain types of data to a place outside the PRC Mainland, including to Hong Kong,” says Dominic Edmondson, Special Counsel, Baker McKenzie, Hong Kong.

“But it remains to be seen whether the new rules are drafted in a way that further facilitates or encourages the flow of data collected or stored in Hong Kong into Mainland areas of the GBA,” he says.

In the long term, enhanced connectivity to the Greater Bay Area population, as a result of the deal, has the potential to cement Hong Kong’s status as a global data hub.

“Hong Kong already has a substantial network of subsea cables that connects the city with global metros, strong telecommunications coverage, and a global ecosystem of enterprises,” says Cathie Chung, Senior Director, Research, JLL Hong Kong.

Along with the new deal, these conditions make the established data centre market an ideal hub. “It can serve as a staging ground for operators planning to enter the Mainland market, or as an outbound hub for Chinese operators and enterprises to expand globally,” Chung says.

The relaxation of cross-border data transfers would be particularly welcomed by many companies operating in Mainland China.

Under the Personal Information Protection Law and the Data Security Law of the PRC, the transfer of personal data and “important data” from GBA locations in the Mainland to Hong Kong is currently only possible if one of three criteria is fulfilled, according to Edmondson.

”This includes either the use of standard contractual clauses published by the CAC, the obtaining of certification by the transferor, or — depending on whether personal data volume thresholds are met or the nature of the transferor’s operations — a lengthy security assessment review by the CAC,” says Edmondson. “In some circumstances, the security assessment is the only permitted option.”

But this could change with the introduction of the new rules.

“Depending on what the new rules entail, having a data centre in Hong Kong may become a more straightforward option for companies that would otherwise need to set up a facility in Guangdong province to store certain types of data in Mainland locations of the GBA,” says Edmondson.

The challenges of acquiring the necessary licences to build and operate a data centre in Mainland China, and the power scarcity in neighbouring Shenzhen, also work in Hong Kong’s favour.

“It’s comparatively easier to set up a data centre in Hong Kong,” says Fung. The agreement will provide an additional incentive to lure operators to the city, where they can expand as a hub to serve the wider population in the Greater Bay Area, he adds.

Development in the city has been on the rise in recent years, with roughly 500 MW of data centre capacity slated to come online by 2028 — building on the 600 MW of capacity available today, JLL data shows.

While some operators, particularly from Mainland China, may be enticed by the Hong Kong data centre market as a result of the recent memorandum, there may also be others looking at new markets not bound by cross-border data transfer and other legal restrictions.

A natural alternative would be Singapore, the prime data centre hub in Asia Pacific and one of Hong Kong’s closest competitors. “However, Singapore has no excess capacity available at the moment to absorb demand from Hong Kong,” says Glen Duncan, Data Centre Research Director, Asia Pacific, JLL.

This means there could be a spillover effect on emerging markets in the region, including Johor Bahru, Malaysia and Batam, Indonesia, where new construction is underway, according to Duncan.

At the moment, however, details on the full extent of the new rules remain scant.

“A majority of data centre operators are adopting a wait-and-see approach,” says Fung. “Whether the new rules make Hong Kong a more attractive place for data centre operations will depend in part on the level of clarity provided by the Hong Kong government and the CAC in the new rules.”