Lawmaker urges disciplinary action for govt dept heads over data leak incidents

The heads of the government departments should bear the responsibility or face disciplinary action for data leak incidents in the future, said DAB lawmaker Elizabeth Quat Pui-fan.

Her comments came after the recent data leakage incidents involving the Companies Registry and the Electrical and Mechanical Services Department (EMSD).

Quat said Monday that the government must conduct a follow-up investigation and hold the contractor accountable for the data leaks.

She added that asking the Office of the Government Chief Information Officer to monitor 70 government departments and oversee hundreds of government systems is not practical regarding responsibilities.

She suggested that the Civil Service Bureau ask all department heads to strengthen network security and protect personal privacy adequately. 

“Punishment mechanisms should be in place, including disciplinary actions, if similar incidents happen again,” Quat said.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said the recent data leak of the Registry was attributed to the system design and should have been discovered before the system launch.

Regarding the recent data leaks from the EMSD, Fong said the staff should have stored personal data within the government intranet during the pandemic and lockdowns.

He added that public data should not be stored on public cloud servers as the contractor might change the system permissions later on.