[ ] ÿ ÿ ÿ Territorial scope of data protection laws 17.12 The simplest logical method of regulating data transferred from the territory would be to subject it to the same regulatory framework as that applied within Hong Kong, whether or not the data processing was conducted or controlled in Hong Kong. But giving the law this extraterritorial scope is subject to the constraints of constitutional law. A common law doctrine of uncertain ambit limits the ability of a colonial legislature to enact laws with extraterritorial effect. The basis of this limitation derives from the limited grant of legislative power accorded colonies such as Hong Kong. Hong Kong is only empowered to enact legislation for the " " peace, order and good government of the colony. Laws which do not have a " real and substantial relation" to the colony are vulnerable to being struck down as invalid by the courts. Such a nexus may not be made out merely because the data processed out ofHong Kong relates to a Hong Kong resident. The Hong Kong (Legislative Powers) Order 1986 provides for some limited exceptions which would not encompass data protection. There is also the practical consideration that if the data are not processed or controlled within Hong Kong, effective enforcement action by the local oversight authority is precluded. This is no doubt why ' other countries not subject to this territory s constitutional limitations have legislated in terms that ensure that effective enforcement remains feasible. 27