Office of the Privacy Commissioner for Personal Data

Office of the Privacy Commissioner for Personal Data

個人資料私隱專員公署
Statutory body overview
Formed	1 August 1996 (1996-08-01)
Jurisdiction	Hong Kong
Headquarters	12/F, Dah Sing Financial Centre, 248 Queen's Road East, Wanchai, Hong Kong.
Motto	Protect, Respect Personal Data Privacy
Minister responsible	Ms Ada Chung, Privacy Commissioner for Personal Data
Deputy Ministers responsible	Ms Fanny Wong, Deputy Privacy Commissioner for Personal Data Assistant Privacy Commissioners: Ms Joyce Lai(Corporate Communication and Compliance) Ms Cecilia Siu (Legal, Global Affairs and Research) Mr Billy Kwan (Complaints and Criminal Investigation)
Key document	Personal Data (Privacy) Ordinance
Website	www.pcpd.org.hk

Office of the Privacy Commissioner for Personal Data
Traditional Chinese	個人資料私隱專員公署
Transcriptions Yue: Cantonese Yale Romanization Go yàhn jī liuh sī yán jyūn yùhn gūng chyúh Jyutping Go3 jan4 zi1 liu6 si1 jan2 zyun1 jyun4 gung1 cyu5

The development of The Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong can be traced back to the enactment of the Personal Data (Privacy) Ordinance (PDPO) in 1995, which aimed to regulate the collection, use, and disclosure of personal data by individuals and organisations.

The PDPO was a significant milestone in the development of privacy protection in Hong Kong. It established a legal framework for the protection of personal data and set out the responsibilities of data users and data subjects. However, it lacked an independent regulatory body to oversee and enforce compliance with the ordinance. Recognizing the need for an independent authority to enforce the PDPO, upon the enactment of the Personal Data (Privacy) Ordinance (PDPO), the PCPD was established under section 5(1) of the Ordinance. The PCPD was given the power to investigate complaints, issue enforcement notices, and promote compliance with the PDPO. It operates independently from the government and is accountable to the Privacy Commissioner, who is appointed by the Chief Executive. Over the years, the PCPD has undergone evolutions and developments to keep up with the emerging challenges in the contemporary complex society.

One prominent development would be the amendments to the PDPO. There have been discussions on amending the law to better personal data protection within the territory. The amended ordinance took effect in late 2021, namely the Personal Data (Privacy) (Amendment) Ordinance (PDPAO). The PDPAO differentiated itself from the PDPO by the main feature of criminalising doxxing acts (i.e. to openly expose someone’s private personal data such as name, address and occupation). Section 64(3A) of the amended ordinance reads, "A person commits an offence if the person discloses any personal data of a data subject without the consent of the data subject...".

The scope of the PCPD was therefore expanded in the sense that it was empowered to investigate criminal activities including doxxing, as well as the authority to initiate legal proceedings for prosecution for the related offences. In addition, the Privacy Commissioner was also granted the statutory powers to ensure the cessation of sharing doxxing messages. Under the Amendment Ordinance, the PCPD is given new criminal investigation and prosecution powers to handle doxxing cases on a "one-stop" basis from criminal investigation to collection of evidence and prosecution.

To catch up with the global evolving privacy landscapes, the PCPD also engaged in international privacy-related initiatives. For instance, the PCPD participates in the Data Privacy Subgroup under the Digital Economy Steering Group which concerns cross-border transfers of information; the PCPD also actively participated in forums convened by members of the Asia Pacific Privacy Authorities, discussing and sharing a wide range of issues related to privacy and security. These engagements allow the PCPD to develop into a more comprehensive body via the exchange of ideas and knowledge, so that it could better contribute to the development of privacy policies and standards both inside and outside Hong Kong.

Literature review

With a similar global status where Hong Kong and Singapore are both highly developed Asian financial hubs renowned for their well-developed economies, consummate infrastructure, and favourable business environments, the privacy laws are slightly different between the two.

Whereas the privacy law in Hong Kong is governed by the PDPO as previously mentioned, the authority in Singapore would be the Personal Data Protection Act (PDPA). In compliance with the PDPA, the Personal Data Protection Commission (PDPC) as the enforcement body (similar to the PCPD). It governs the collection, use, disclosure and care of personal data in Singapore (Chesterman, 2012). ^[12]

The main differences lie in their enforcement. The way and nature of deterrence is found very distinct between Hong Kong and Singapore. Non-compliance in Hong Kong would result in criminal offences charged and monetary fines, illustrated in section 64(3B) of the PDPO, "A person who commits an offence under subsection (3A) is liable on conviction to a fine at level 6 and to imprisonment for 2 years". For the case in Singapore, the penalty is more inclined to the administrative aspect. Section 48I sets out the directions for non-compliance, which is to "give the organisation or person (as the case may be) any direction that the Commission thinks fit in the circumstances to ensure compliance with that provision". It is more lenient and flexible compared to that in Hong Kong.

Controversies

The Personal Data (Privacy) Amendment Ordinance 2021

The proposal of the Amendment Bill is to address the issue of invasive doxxing acts that violate personal data privacy by making doxxing acts a criminal offence and empowering the Commissioner with statutory power to issue cessation notices, which require the immediate cessation or limitation of the disclosure of doxxing content. ^[13] However, the amendment was criticised for giving excessive power to the PCPD such as the power to initiate criminal investigation and power to prosecute. ^[14] The Asian Internet Coalition (AIC), an industry association of leading Internet and technology companies in the Asia Pacific region, expressed its concern that the ambiguous definition of "doxxing acts":

"The definition of "doxxing acts" in the proposed amendments creates problematic ambiguity - in particular, given that at present there is no universally accepted or acknowledged definition for "doxxing", this gives rise to legitimate concerns that "doxxing" in the proposed amendments could have an overly broad interpretation such that even innocent acts of sharing of information online could be deemed unlawful under the PDPO." ^[15]

AIC also suggested the proposed anti-doxxing provision did not consider legitimate situations where personal data may be disclosed without the data subject's consent, e.g. disclosing personal data for public interests.

Anonymous Open Letter by the Staff of the PCPD

In 2019, An anonymous open letter was issued by people claiming to be the staff of the PCPD to express views regarding the social incidents. In response to the letter, the PCPD issued a statement. ^[16]

Reported data privacy issue of public concern

2010 Octopus sold personal data of customers for HK$44m

In 2010, it was reported that Octopus Card issuer has made HK$44 million in the past 4+1⁄2 years by selling cardholder data. This was disclosed in a special hearing conducted by the personal data privacy commissioner. Octopus Holdings chief executive Prudence Chan Bik-wah said she wished to 'sincerely apologise' to affected cardholders. ^[17]

2010 Six banks transfer personal data for marketing purposes

In August 2010, the Hong Kong Monetary Authority publicly disclosed that CITIC Bank International, Citibank, Fubon Bank, Industrial and Commercial Bank of China, Wing Hang Bank, and Wing Lung Bank were guilty of transferring customer data to unaffiliated parties for marketing purposes. In a separate investigation, the privacy commissioner for personal data concluded that the actions of some of the banks were equivalent to the sale of personal data. ^[18]

2017 Notebooks containing HK voters data was stolen

The Registration and Electoral Office reported in March 2017, right after the chief executive election, that they have lost 2 laptop computers containing 3.7 million voters personal information. This could be one of the most significant data breaches ever in Hong Kong, consider the city population is less than 8 million. ^[19]

HK Leaks

Since 2019, a website called HK Leaks has published personal information on more than 2,000 pro-democracy figures. When asked in August 2021 about if the site violated any laws, the PCPD said it would not comment on individual cases, and repeated the same response in May 2023. ^[20]

To My Nineteen Year Old Self

In 2023, this documentary "To My Nineteen Year Old Self" was allegedly in violation of students’ consent for filming the documentary. The Privacy Commissioner for Personal Data, Ms. Ada Cheung Lai Ling stated that PCPD has contacted the school for further information. She also said that according to the Personal Data (Privacy) Ordinance, if the purpose for the collected data has changed, consent should be obtained from the data subject. Data subject also has the right to withdraw the consent that he or she has given. ^[21] In the media statement of the PCPD in response to this incident, the PCPD has not received any complaint or inquiry concerning the incident. ^[22]

Personal Data Breach Incidents of the Registration and Electoral Office

In 2022, two personal data breach incidents involving the Registration and Electoral Office (REO) were investigated by the PCPD. In the first incident, a staff member of the REO mistakenly sent files containing the data of around 15,000 electors to an unknown recipient. The PCPD stated that this incident was mainly due to human errors. ^[23]

In the second incident, the REO attached a reply slip containing personal data of an Election Committee (EC) member and their assistant (names, email addresses and phone numbers) to an email sent to 38 EC members and 26 assistants. After investigation, the PCPD concluded that this incident was also due to human errors. According to the Privacy Commissioner, Ms Ada CHUNG Lai-ling, these two incidents revealed that REO has not taken practicable steps to ensure that personal data was protected from unauthorised or accidental access, processing, erasure, loss or use, therefore contravening the DPP4(1) concerning the security of personal data under the Personal Data (Privacy) Ordinance.

Prohibition on Face Covering Regulation

In response to the concerns raised by the prohibition on face covering, the PCPD stated that the Prohibition on Face Covering Regulation was not in conflict with the Personal Data (Privacy) Ordinance with reason that the rights of the suspects would not override the public interests for the timely and effective prevention, detection, and apprehension or prosecution of the police. ^[24] The PCPD suggested that the privacy rights can also be restricted by public order and national security concerns.

Tightening Search Arrangement

In 2021, the Hong Kong government proposed to tighten company search, including that the residential address and identification number of directors and company secretaries would not be accessed by the public, ^[25] that the search requires personal identification information such as name and HKID number ^[26] and that the individual registered vehicle owner will be notified by the search for vehicle registration in the Transport Department. ^[27]

The PCPD stated that the tightening arrangement by the Transport Department was not problematic from the perspective of Persona Data (Privacy) Ordinance. ^[28] In response to the several measures by the government to tighten search arrangements, The Privacy Commissioner for Personal Data, Ms. Ada Cheung Lai Ling stated that whether the restriction was proportionate depends on the purposes of the search arrangements. ^[29]

Limitations

Lack of Deterrence

During 2022-2023, more than a thousand of cessation notices were sent to 28 online platforms. Most of them were operated by overseas service providers, requesting the removal of nearly 20,000 ^[30] doxxing messages. Although the compliance rate for removing these messages was high, it took a long time to request the service providers to delete them. Even if the content is deleted, the victim has been harmed for a long time.

The maximum fine of HK$50,000 and a prison sentence of up to 2 years was introduced in 1996. However, it is widely believed that the effectiveness of this penalty in deterring offenses is relatively low. Privacy Commissioner Chung Lai Ling stated in an interview that the principle of the Privacy Ordinance is voluntary and clear. If the company notifies the customers that their personal data will be transferred and states the purpose of use, the situation is legal. The incidents that occurred before were just independent events. However, she believes that the deterrent effect is no longer enough, and the PCPD is cooperating with the government to review the relevant penalties. ^[31]

References

1. "What We Do".
2. "Organisation Chart".
3. "External Connection". www.pcpd.org.hk. Retrieved 10 April 2023.
4. OECD. (1980, September 30). Organisation for Economic Cooperation and Development guidelines Annex to the recommendation of the Council of 23 September 1980 Guidelines governing the protection of privacy and transborder flows of personal data. uniandes.edu.co. Retrieved December 15, 2023, from https://habeasdatacolombia.uniandes.edu.co/wp-content/uploads/OECD_Privacy_Guidelines_1980.pdf
5. Lau, Ka-men (2000). Privacy Commissioner Overview Annual Report 2000. https://www.pcpd.org.hk/english/resources_centre/publications/annual_report/files/annualreport2000.pdf .
6. Privacy Commissioner Overview Annual Report 2000
7. Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Welcome Message from the Privacy Commissioner for Personal Data. Office for the Privacy Commissioner for Personal Data, Hong Kong. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/commissioner/commissioner.html
8. GovHK. (19 September 2023). GOVHK: Principal officials of the Hong Kong Special Administrative Region . https://www.gov.hk/en/about/govdirectory/po/index.htm
9. Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Functions/ Responsibilities of PCPD. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/our_organisation/staff/executive_staff.html
10. Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Personal Data (Privacy) Advisory Committee. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/committees/pdac/personal_data_advisory_committee.html
11. Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Standing Committee on Technological Developments. Standing Committee on Technological Developments. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/committees/sctd/standing_committee_on_technological_developments.html
12. Chesterman, S. (2012). AFTER PRIVACY: THE RISE OF FACEBOOK, THE FALL OF WIKILEAKS, AND SINGAPORE’S "PERSONAL DATA PROTECTION ACT 2012." Singapore Journal of Legal Studies, 391–415. JSTOR   24872218
13. Office of the Privacy Commissioner for Personal Data. (n.d.). The Personal Data (Privacy) Amendment Ordinance 2021. https://www.pcpd.org.hk/english/data_privacy_law/amendments_2021/amendment_2021.html#:~:text=The%20Amendment%20Bill%20ai ms%20to,of%20disclosure%20of%20doxxing%20contents
14. 【起底刑事化】草案賦私隱專員刑事檢控、搜處所資訊解密權 下周三首讀. (15 July 2021). 立場新聞. https://collection.news/thestandnews/articles/147856
15. Asia Internet Coalition (2021). Industry Response on the Proposed Amendments to Hong Kong’s Personal Data (Privacy) Ordinance and Request for Virtual Meeting with PCPD. https://aicasia.org/wp-content/uploads/2021/07/Industry-Response-on-the-Proposed-Amendments- to-Hong-Kongs-Personal-Data-Privacy-Ordinance-and-Request-for-Virtual-Meeting.pdf
16. Office of the Privacy Commissioner for Personal Data. (2019). Privacy Commissioner responds to media reports on open letter issued by purported PCPD staff. https://www.pcpd.org.hk/english/news_events/media_statements/press_20190814.html
17. SCMP report - Octopus sold personal data of customers for HK$44m 2010-07-27. Retrieved 2018-06-06
18. Chiang, Allan (15 December 2011). "Transfer of Customers' Personal Data by CITIC Bank International Limited to unconnected third parties for direct marketing purposes" (PDF).
19. Laptops containing 3.7 million Hong Kong voters’ data stolen after chief executive election. SCMP reported 2017-03-28. Retrieved 2018-06-06
20. Grundy, Tom (22 May 2023). "Hong Kong doxxing site targeting journalists, activists still online almost 2 years after authorities alerted". Hong Kong Free Press HKFP. Retrieved 22 May 2023.
21. 給十九歲的我|私隱公署已聯絡英華:倘使用資料目的有變需取同意. (22 February 2023). HK01. https://www.hk01.com/%E7%A4%BE%E6%9C%83%E6%96%B0%E8%81%9E/865395/%E7%B5%A6%E5%8D%81%E4%B9%9D%E6 %AD%B2%E7%9A%84%E6%88%91- %E7%A7%81%E9%9A%B1%E5%85%AC%E7%BD%B2%E5%B7%B2%E8%81%AF%E7%B5%A1%E8%8B%B1%E8%8F%AF- %E5%80%98%E4%BD%BF%E7%94%A8%E8%B3%87%E6%96%99%E7%9B%AE%E7%9A%84%E6%9C%89%E8%AE%8A%E9%9 C%80%E5%8F%96%E5%90%8C%E6%84%8F
22. Office of the Privacy Commissioner for Personal Data. (2023). Privacy Commissioner’s Office’s Response to the Incident relating to the Film To My Nineteen-Year-Old Self. https://www.pcpd.org.hk/english/news_events/media_statements/press_20230206.html
23. Office of the Privacy Commissioner for Personal Data. (2022). Privacy Commissioner’s Office Publishes an Investigation Report on Two Personal Data Breach Incidents of the Registration and Electoral Office. https://www.pcpd.org.hk/english/news_events/media_statements/press_20221229.html
24. 【禁蒙面法】私隱專員公署:與現行私隱條例無衝突 違法者不容以私隱作避風港. (4 October 2019). 立場新聞. https://collection.news/thestandnews/articles/102484
25. 政府重提收緊公司查冊 林鄭月娥:看不到為何記者要有特權(30 March 2021). Ming Pao. https://news.mingpao.com/ins/%E6%B8%AF%E8%81%9E/article/20210330/s00001/ 1617073832078/%E6%94%BF%E5%BA%9C%E9%87%8D%E6%8F%90%E6%94 %B6%E7%B7%8A%E5%85%AC%E5%8F%B8%E6%9F%A5%E5%86%8A- %E6%9E%97%E9%84%AD%E6%9C%88%E5%A8%A5- %E7%9C%8B%E4%B8%8D%E5%88%B0%E7%82%BA%E4%BD%95%E8%A8% 98%E8%80%85%E8%A6%81%E6%9C%89%E7%89%B9%E6%AC%8A
26. 收緊查冊|公司註冊處、土地註冊處下月起 查冊須登記姓名身份證. (25 October 2021). HK01. https://www.hk01.com/%E7%A4%BE%E6%9C%83%E6%96%B0%E8%81%9E/692739/%E6%94%B6%E7%B7%8A%E6%9F%A5%E5 %86%8A-%E5%85%AC%E5%8F%B8%E8%A8%BB%E5%86%8A%E8%99%95- %E5%9C%9F%E5%9C%B0%E8%A8%BB%E5%86%8A%E8%99%95%E4%B8%8B%E6%9C%88%E8%B5%B7%E6%9F%A5%E5%8 6%8A%E9%A0%88%E7%99%BB%E8%A8%98%E5%A7%93%E5%90%8D%E8%BA%AB%E4%BB%BD%E8%AD%89
27. 運輸署收緊查冊限制 傳媒工會批礙新聞自由 憂披露記者資料(6 January 2021). HK01. https://www.hk01.com/%E7%A4%BE%E6%9C%83%E6%96%B0%E8%81%9E/570587/%E9%81%8B%E8%BC%B8%E7%BD%B2%E6 %94%B6%E7%B7%8A%E6%9F%A5%E5%86%8A%E9%99%90%E5%88%B6-%E5%82%B3%E5%AA%92%E5%B7%A5%E6%9C%83%E6%89%B9%E7%A4%99%E6%96%B0%E8%81%9E%E8%87%AA%E7%9 4%B1-%E6%86%82%E6%8A%AB%E9%9C%B2%E8%A8%98%E8%80%85%E8%B3%87%E6%96%99
28. 私隱署接起底投訴減 76% 專員稱政府改查冊做法沒問題 (28 January 2021). Ming Pao. https://news.mingpao.com/ins/%E6%B8%AF%E8%81%9E/article/20210128/s00001/1611818553489/%E7%A7%81%E9%9A%B1%E7% BD%B2%E6%8E%A5%E8%B5%B7%E5%BA%95%E6%8A%95%E8%A8%B4%E6%B8%9B76- %E5%B0%88%E5%93%A1%E7%A8%B1%E6%94%BF%E5%BA%9C%E6%94%B9%E6%9F%A5%E5%86%8A%E5%81%9A%E6%B
29. 傳媒未獲豁免查冊 私隱專員:或需修例 (19 November 2022). Ming Pao. https://news.mingpao.com/ins/%E6%B8%AF%E8%81%9E/article/20221119/s00001/1668838808776/%E5%82%B3%E5%AA%92%E6% 9C%AA%E7%8D%B2%E8%B1%81%E5%85%8D%E6%9F%A5%E5%86%8A- %E7%A7%81%E9%9A%B1%E5%B0%88%E5%93%A1-%E6%88%96%E9%9C%80%E4%BF%AE%E4%BE%8B
30. Office of the Privacy Commissioner for Personal Data. (2023). 2022-2023 Annual Report. https://www.pcpd.org.hk/tc_chi/resources_centre/publications/annual_report/files/anreport23_full.pdf
31. 私隱專員:私隱條例罰則阻嚇力不足 正審視修訂. (19 November 2022). AM730. https://www.am730.com.hk/%E6%9C%AC%E5%9C%B0/%E7%A7%81%E9%9A% B1%E5%B0%88%E5%93%A1%E7%A7%81%E9%9A%B1%E6%A2%9D%E4%B E%8B%E7%BD%B0%E5%89%87%E9%98%BB%E5%9A%87%E5%8A%9B%E4 %B8%8D%E8%B6%B3%E6%AD%A3%E5%AF%A9%E8%A6%96%E4%BF%AE %E8%A8%82/348632

External links

• Official website
• Personal Data (Privacy) Ordinance (Cap. 486)