Heavier penalties loom for personal privacy breaches

Ayra Wang

The administration is examining amendments to the Personal Data (Privacy) Ordinance that will establish a mandatory notification mechanism and increase penalties, Secretary for Constitutional and Mainland Affairs Erick Tsang Kwok-wai told Legislative Council members yesterday.

Tsang said authorities will consider implementing the amendments in phases, setting penalties at a level that provides a deterrent effect and minimizing the impact on local enterprises.

He also said incidents involving personal data breaches in Hong Kong have remained relatively stable at around 100 cases per year, though a significant rise to 217 incidents last year raised concerns.

Tsang said the Office of the Privacy Commissioner for Personal Data has completed a review of the ordinance and made preliminary proposals.

These include establishing a mandatory privacy breach notification mechanism, directly regulating data processors, requiring data users to formulate personal data retention policies, increasing penalties and clarifying the definition of personal data.

Contravention of an enforcement notice currently carries a maximum penalty of a HK$50,000 fine and two years' imprisonment. If the offense continues after conviction, there will be a daily fine of HK$1,000 until it ceases.

For subsequent convictions, the maximum fine increases to HK$100,000 and daily penalty increases to HK$2,000.

The term of imprisonment remains unchanged.

In other news, the administration opened up for public consultation last month for proposed enhancements to the Banking Ordinance.

These would allow information sharing among banks regarding customers, accounts and transactions to detect and prevent financial crimes.

Tsang said the government plans to add provisions to ensure information is shared only when banks have reasonable suspicion an account may be involved in crimes such as fraud, money laundering and terrorist financing.

Legco member Carmen Kan Wai-mun urged the government to expedite the amendment of the Banking Ordinance, suggesting that financial institutions and telecommunications companies be held accountable for failing to fulfill anti-fraud obligations when scams occur.

Undersecretary for Financial Services and the Treasury Joseph Chan Ho-lim said that similar measures are already in effect, affirming that e-banking customers in Hong Kong will not take on losses from unauthorized transactions unless there is evidence of fraud or gross negligence.