within the country. 18.9 Nugter points out that a consequence of this diversity of approaches to territorial application is that ofpotential overlap. A located in the Netherlands and processed in France by a computer bureau at the behest of a UK based data controller will be subject to laws of all three countries. 18.10 In choosing an appropriate criterion to determine the territorial scope of a data protection law for Hons Kona, we consider the crucial factor to be whether the data use is controlled within Hons Kong，whether or not the processing is undertaken here. We also save careful consideration to whether we. also wished to fully regulate data processing within Hons Konÿwhere the data controller is outside Hons Kons. We concluded that to do so generally could lead to practical problems. For example , it could be argued that Hong Kong Telecom processes all international telephone calls transmitted through Hong Kong , even though the calls originated and terminated outside the territory . We do not think that to the extent that Hong Kong data users act purely, as processing conduits between other countries, they should be subject to the full force of Hong Kong's data protection regime as regards such data. The application of some of the data protection principles will remain appropriate, however, such as that relating to data security. We therefore recommend that the general provisions of the data protection law apply to the processing ofpersonal data whether or not in Hong Kong, provided the data controller is in the territory. Data process within Hong 33