By Claire Chow

Hong Kong, 29 December 2023: Organisations have been reminded by the Privacy Commissioner to implement robust data protection measures after popular online marketplace Carousell suffered a “serious” leak of users’ personal information in January last year. After investigating the incident, Hong Kong’s privacy watchdog has published a report which includes a list of recommendations designed to prevent such data security lapses.

Carousell is a Singapore-based retail platform for the buying and selling of new and second-hand goods. It operates in its home city plus Hong Kong, Malaysia, Indonesia, the Philippines and Taiwan, with tens of millions of users. In October 2022 it discovered that the personal data of 2.6 million users – including almost 325,000 in Hong Kong – was being sold on the dark web. It immediately informed the Privacy Commissioner and the affected customers.

The platform said the data breach was caused by a security vulnerability that was introduced during a system migration in January 2022. Hackers accessed and stole the information – including email addresses, phone numbers and birthdays – during the following May and June. The stolen information could allow criminals to directly contact victims, or steal their identity to scam others, or access other accounts belonging to them.

After completing her investigation, Privacy Commissioner Ada Chung listed five deficiencies causing the leak: failure to conduct a privacy impact assessment prior to the system migration; incomprehensive code review process; inadequate security assessment associated with the system migration; lack of a written policy in relation to the code review process; and lack of effective detection measures.

Considering Carousell’s extensive international operations and the vast number of active users it serves, Ms Chung said it was “reasonable to expect that the Carousell Group, including Carousell Limited in Hong Kong, would have invested sufficient resources in ensuring the robust security of its information systems”. However, the incident revealed “fundamental failures” to ensure personal data security. She observed that the leak “could have been avoided if some normal risk and security assessment procedures and tools had been implemented”.

The Privacy Commissioner concluded that Carousell had not taken all practicable steps in relation to the system migration to ensure that the personal data was protected from unauthorised or accidental access, processing, erasure, loss or use, thereby contravening Data Protection Principle 4(1) of the Personal Data (Privacy) Ordinance (Cap 486) (the “PDPO”).

She has served an Enforcement Notice on the platform, directing it to remedy and prevent recurrence of the contravention. Steps it must take include engaging an independent data security expert to review its web and mobile applications, conducting security assessments and improving data protection training for all staff. Carousell has two months to provide documentary proof that it has implemented the measures.

As part of her report, Ms Chung has made the following recommendations on strengthening security to organisations which may perform information system migration involving personal data:

• Carry out privacy impact assessments, especially when significant changes are made to systems;
• Develop a migration plan that prioritises data protection;
• Conduct effective vulnerability assessments;
• Provide relevant employee training;
• Implement an effective mechanism for detecting abnormal activities; and
• Formulate localised policies and procedures to ensure compliance with the PDPO.

In addition, given that the Carousell Group is based in Singapore, the Privacy Commissioner has shared her report with Singapore’s Personal Data Protection Commission in accordance with a Memorandum of Understanding between the two bodies.

The report is a timely reminder that data leaks and other cyber security breaches are increasing worldwide, leaving individuals and organisations exposed not only to immense inconvenience but also reputational damage, financial loss and potential legal consequences. Robust safety systems help maintain sound business relationships, increase public confidence and reduce the risk of litigation.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.