to serve any enforcement notice on foreign entities who has no operations in Hong Kong, not to speak of further steps concerning criminal sanctions. 66. For the above reasons ， the Board finds that the scope/territorial jurisdiction of the Ordinance covers only persons being data user who has operations controlled in or from Hong Kong. F . Whether the Application of the Ordinance Is Based on the Control Requirement，，and/or the "Processinu Requir-ement" " 67. The issue arises from the broad ground of appeal no. 2 of the Appellant. The Appellant submitted that the Control Requirement and the Processing Requirement are both sufficient requirements under the Ordinance such that if Google LLC's operations satisfy either one of the two requirements which take place in Hong Kong then Google LLC has operations within Hong Kong so as to be caught by the scope of the Ordinance. By processing requirement the Appellant means whether there is a "real and substantial" processing of the data (which covers collection, holding, processing and use) in Hong Kong which is a wider meaning , given to the word " " processing . The Respondent submitted that the Control Requirement is the sole test whereas Google LLC submitted that both requirements form the necessary requirements so that both have to be operated in Hong Kong. 68. To resolve this question of law, the basic provision which need to be " understood is the interpretation of data user" in section 2(1) of the Ordinance which defines the term as "data user, in relation to personal data, means a person who, either alone or jointly or in common with other 51