whether or not the data is held within the territory. [...] DELIBERATIONS [ÿÿÿ] B . Territorial scope of data protection laws 18.5 The simplest logical method of regulating data transferred from the territory would be to subject it to the same regulatory framework as that applied within Hong Kong, whether or not the data processing was conducted or controlled in Hong Kong. But giving the law this extraterritorial scope is subject to the constraints of constitutional law. A common law doctrine of uncertain ambit limits the ability of a colonial legislature to enact laws with extraterritorial effect. The basis of this limitation derives from the limited grant of legislative power accorded colonies such as Hong Kong. It is only empowered to enact legislation for the " peace, order and good government “ of the colony. Laws which do not have a "real and substantial relation “ to the colony are vulnerable to being struck down as invalid by the courts. Such a nexus may not made out merely because the data processed out of Hong Kong relates to a Hong Kong resident. The Hong Kong (Legislative Powers) Order 1986 provides for some limited exceptions which would not encompass data protection. There is also the practical consideration that if the data are not processed 31