17.16 In choosing an appropriate criteria to determine the . territorial scope of a data protection law for Honi! Konÿ , the two obvious factors are control and processing. We think it important that, in the interests ofpromoting the continuedfreeflow of data to Hong Kong, Hong Kong not become a data haven free of effective , controls on personal data. To that end’ we think it important that , for instance, the data protection law in Hong Kong should continue to apply to a data controller in the jurisdiction even where the data , has been transferred to another jurisdiction. 17.17 There are three ways of providing transborder data protection. The first would be to apply the legislation to processing controlled by a data user within the jurisdiction (as in the United Kingdom). The second would be to apply the provisions where processing of the data had taken place within the jurisdiction (as in France), and the third would be to apply the provisions if the data related to citizens of that country. The sub-committee took the view that a control test should be applied but we have concluded that this needs to be supplemented by the second test, whereby the law would apply to data processed in Hons Kons, whether or not the data controller was based here. This would reassure other countries that Hong Kong would not become a data haven. For example, the data controller based in France might only be prepared to transfer data to Hong Kong if the data continued to be subject to a data protection law. The French law would cease to protect the data following transfer, as that law lacks a control test. Nor would the control test apply to the processing of data in Hong 29