“ as the case may be, is required or permitted under this Ordinance. (emphasis added) 43. Schedule 1 (titled “data protection principles”、of the Ordinance " provides for six data protection principles ( DPP"). For instance, DPP 1(1 )(a) provides that "personal data shall not be collected unless the data is collectedfor a lawful purpose directly related to a function or activity of the data user who is to use the data ”. 44. Section 2(1) (under the title: ÿinterpretation") of the Ordinance " provides that data user, in relation to personal data, means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data “ (emphasis added). It " also provides that processing, in relation to personal data, includes amending, augmenting, deleting or rearranging the data, whether by automated means or otherwise 45. There is no provision in the Ordinance which directly specifies its territorial jurisdiction, i.e. whether a person/entity who controls the collection, holding, processing or use of the data but do so outside of Hong Kong is caught by the Ordinance and subject to its applicability and hence the powers of the Respondent. 46. Section 33(1) (under the title: “prohibition against transfer of personal data to place outside Hong Kong except in specified " circumstances ) of the Ordinance, which is not yet in operation, provides that "this section shall not apply to personal data other than personal data the collection, holding, processing or use of which- (a) takes place in 38