URA warned over private data leak

Wallis Wang

The Urban Renewal Authority has received a warning letter from the Privacy Commissioner for Personal Data following the online leak of personal information belonging to 199 individuals who participated in a URA briefing.

In a statement released yesterday, the PCPD criticized the URA for its delayed software updates and inadequate understanding of the software used to collect personal data.

In May last year, the URA conducted briefing sessions regarding property acquisition under the Nga Tsin Wai Road/Carpenter Road Development Scheme in Kowloon City, utilizing an e-form platform linked to the cloud service ArcGIS Online for participant registration.

Unfortunately, the personal data of 199 homeowners and tenants - including their names, mobile phone numbers, and addresses - was exposed, as it could be accessed without logging into an account.

The URA's investigation into the contractor responsible for the e-form platform revealed that the incident was due to the use of an outdated version of the software, which lacked enhanced data protection features.

The PCPD said: "The URA acknowledged that had the software been updated to the latest version, this incident would not have occurred."

Privacy Commissioner Ada Chung Lai-ling concluded that the URA "had not taken all practicable steps to safeguard the personal data against unauthorized or accidental access, processing, erasure, loss or use," thus violating the Data Protection Principle outlined in the Personal Data (Privacy) Ordinance.

As a result, the PCPD has issued a warning letter to the URA, urging the implementation of measures to strengthen personal data protection and prevent similar incidents in the future.

The commissioner has also updated its guidance on cloud computing, clarifying the requirements relevant to organizations seeking to enhance personal data privacy.

wallis.wang@singtaonewscorp.com