Watchdog advices virtual bank to strengthen data management

The office of the Privacy Commissioner for Personal Data has called on a virtual bank with almost 700,000 retail customers to strengthen management of data processing to prevent leakage.

But the watchdog said ZA Bank, one of the biggest virtual banks in the SAR, has generally complied with legal requirements in handling customers' data.

ZA Bank handles vast amounts of sensitive information on a daily basis, so privacy commissioner Ada Chung Lai-ling had wanted to check its personal data system.

The bank was granted a virtual banking license by the Hong Kong Monetary Authority in March 2019 and became the first virtual bank in the SAR in March 2020, offering digital banking services mainly via the internet and through a mobile app.

The check showed ZA Bank had almost 700,000 retail customers by the end of June.

The commissioner also found the bank had established a privacy program and appointed a dedicated data protection officer to develop a system to comply with requirements of the Personal Data (Privacy) Ordinance and to manage customer information.

The watchdog also said it was pleased to note the bank is committed to protecting personal data by implementing a paperless office, conducting drills to counter the threat of phishing attacks and promoting a culture of privacy in the workplace.

"I hope the findings and recommendations of this inspection will not only assist ZA Bank to further strengthen the protection of its customers' personal data, ensure security and prevent data breach incidents but also serve as a reference for other virtual banks," Chung said.

But ZA Bank was recommended to strengthen management of its data processes, enhance the monitoring capabilities of a data loss prevention system, to limit the time for staff to access customers' personal data, and to continuously and regularly review its personal data system.

Hong Kong has seen multiple data leakage incidents during the last two months.

And the privacy commissioner said last Thursday that reports had been received from five schools and social welfare organizations that their WhatsApp accounts had been hijacked during the past month, resulting in the information of more than 900 individuals being leaked.

And last month Cyberport had some 400 gigabytes of data that included HKID card numbers, bank statements and resumes released on the dark web after a "ransom" was not paid for the stolen information.

Two weeks later the Consumer Council discovered its computer server had been hacked. The council said the data of approximately 8,000 individuals was suspected to have been compromised.