Government proposes reforms to Personal Data Privacy Ordinance amid rising breaches

The government is studying amendments to the Personal Data (Privacy) Ordinance to establish a mandatory notification mechanism and increase penalties, Secretary for Constitutional and Mainland Affairs Erick Tsang Kwok-wai told lawmakers at the Legislative Council meeting on Wednesday.

Tsang also noted that authorities will consider implementing the amendments in phases and setting penalties at a level that provides a deterrent effect while minimizing the impact on local enterprises during a sluggish economy.

"We understand that local businesses are concerned about increasing penalties, particularly the pressure they may place on small and medium-sized enterprises in the current economic environment," Tsang said.

He also said that personal data breach incidents in Hong Kong had remained relatively stable at around 100 cases per year until a significant rise to 217 incidents last year raised concerns within the government.
Tsang said that the Office of the Privacy Commissioner for Personal Data has completed a review of the Ordinance and made preliminary proposals. 

These include establishing a mandatory privacy breach notification mechanism, directly regulating data processors, requiring data users to formulate personal data retention policies, increasing penalties, and clarifying the definition of personal data.

Currently, the sentence carries a maximum fine of HK$50,000 and imprisonment for up to 2 years, along with a daily penalty of HK$1,000. For subsequent convictions, the penalty increases to a maximum fine of HK$100,000 and the same term of imprisonment, with a daily penalty of HK$2,000.

Also, the government launched a public consultation last December on proposed enhancements to the Banking Ordinance. 

This would allow information sharing among banks regarding customers, accounts, and transactions to prevent and detect financial crimes. 

Tsang said that the government plans to add provisions to ensure information is shared only when banks have reasonable suspicion that an account may be involved in crimes such as fraud, money laundering, and terrorist financing.

Lawmaker Carmen Kan Wai-mun urged the government to expedite the amendment of the Banking Ordinance, suggesting that financial institutions and telecommunications companies should be held accountable for failing to fulfill anti-fraud obligations when a scam occurs.

Under Secretary for Financial Services and the Treasury Joseph Chan Ho-lim responded that similar measures are already in effect, affirming that customers of e-banking services in Hong Kong will not bear losses from unauthorized transactions unless there is evidence of fraud or gross negligence.

(Ayra Wang)