The Office of the Privacy Commissioner for Personal Data (PCPD) has confirmed that four local institutions affected by a hacking incident on the Canvas platform did not violate the privacy ordinance.
According to the watchdog's statement on Thursday (Aug 20), among the data breach notifications submitted by seven educational institutions, only four were affected by the incident in May.
The institutions involved are City University of Hong Kong, the Hong Kong Academy for Performing Arts, the Hong Kong Institute of Construction, and the Hong Kong University of Science and Technology.
City University of Hong Kong was the most severely impacted, with the breach compromising the names, email addresses, usernames, student IDs, and course enrollment information of nearly 147,000 students and staff.
The PCPD said the data breach stemmed from vulnerabilities relating to a third-party platform, adding that the incident did not affect the internal systems of the involved institutions.
Investigations revealed that the institutions had conducted pre-assessments prior to deploying Canvas, adopted contractual means, and established monitoring mechanisms.
The Privacy Commissioner for Personal Data, Ada Chung Lai-ling, found no violation of the Personal Data (Privacy) Ordinance, as no evidence suggested the institutions failed to take practicable steps to protect data on Canvas.
The PCPD also recommended the institutions reassess data breach risks, strengthen the monitoring of security measures implemented by third-party platforms, and review and minimize the amount of personal data stored on such platforms.
