Skip to content

Something urgent? Call us now! (852) 3416 1711

Data security: time to review

By Claire Chow

Hong Kong, 3 February 2023: Two personal data leaks by Hong Kong’s electoral office – both caused by human error – have highlighted the importance of cyber security and information protection in the digital age. Businesses and organisations should take note and review their safety mechanisms accordingly.

An investigation by the Office of the Privacy Commissioner for Personal Data found the government’s Registration and Electoral Office (REO) had breached regulations and failed to protect voters’ information. The REO had not taken “all practicable steps” to ensure such details were shielded from unauthorised access, according to the Privacy Commissioner’s report.

In the first incident, during Hong Kong’s fifth wave of Covid-19 infections in March last year, a clerical officer tried to send two spreadsheets with the names and addresses of some 15,000 voters to her personal email so she could work from home the next day. But she typed in the wrong email address and the files went to an unknown recipient.

The following month, during preparations for the Chief Executive election, another REO employee mistakenly attached a reply slip containing details about an Election Committee member when sending a test email to 64 other members or their assistants.

In her investigation, Privacy Commissioner Ada Chung found the first incident stemmed from the officer’s negligence and lack of awareness of the REO’s own guidelines, which stipulated “[staff should] only use the email system of the REO for transmission of classified information through email” and “[staff should not] use personal email accounts for official duties or for transmitting classified information or personal data”. Ms Chung also found the REO had not put in place appropriate information security measures.

The second breach was down to collective negligence and lack of awareness by several staff members and deficiencies in the REO’s workflow, according to the Privacy Commissioner. While working long hours and under pressure to meet deadlines, employees had resorted to last-minute manual checking, thus increasing the risk of human error.

Ms Chung noted: “The two incidents revealed that the Registration and Electoral Office had not taken all practicable steps to ensure that personal data was protected from unauthorised or accidental access, processing, erasure, loss or use.” She concluded the REO had contravened the Personal Data (Privacy) Ordinance. The REO was served with two Enforcement Notices and has since enhanced security measures, including monitoring of its email system, and reviewed workflow procedures.

Concluding her report, Ms Chung provided businesses and organisations with the following recommendations for handling personal data:

  • Thoroughly implement a personal data privacy management programme;
  • Conduct privacy risk assessments and formulate specific guidelines for non-routine work;
  • Devise effective education and training plans on personal data security; and
  • Deploy information security measures to mitigate the risk of human errors.

In conclusion, it should be noted that the digital age is a double-edged sword. While it has brought countless ingenious solutions for processing information, this also means greater threats in terms of cyber security. Personal data loss may include financial, personal and health information.

Such breaches can have devasting consequences for all parties. For an individual, their privacy and security are compromised. For a business or organisation, there are legal, financial and reputational implications. For these reasons, and as highlighted by the REO examples, it is obvious that compliance with relevant data protection laws and robust cyber security measures are in everyone’s best interest.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Criminal Matters, Civil and Commercial Litigation, and Intellectual Property. She can be contacted at Claire@boasecohencollins.com.

39+ years of legal experience is just a click away.

Friendly and approachable, we are ready to answer your questions and offer you sound advice.

Contact us now

BC&C-contact-us

News & Knowledge

Learn more about what we do and what we say. Subscribe to our newsletter to ensure you receive our updates.

  • This field is for validation purposes and should be left unchanged.

Updating copyright for the AI landscape

By Susan Cheung and Nicole Chin Hong Kong, 7 October 2024: The Commerce and Economic Development Bureau and the Intellectual Property Department have jointly published a consultation paper, taking a significant step towards modernising Hong Kong’s copyright regime in response to the rapid advancements in artificial intelligence (AI). The paper addresses key issues regarding copyright […]

Read more

Ian McWalters delivers compelling talk

Hong Kong, 2 October 2024: A large audience gathered at the University of Hong Kong to hear former Justice of Appeal Ian McWalters deliver the sixth annual HKU-Boase Cohen & Collins Criminal Law Lecture. His talk, “The Exercise of Discretion in the Criminal Justice System”, examined discretionary decision making by law enforcement, prosecutors and judicial […]

Read more

The blurred lines of ‘medical beauty’

By Teresa Leung Hong Kong, 25 September 2024: Our city’s largely unregulated “medical beauty” industry is back in the news following the jailing of a beautician over a botched botox injection. It is the latest in a string of cases featuring unlicensed medical practices – some of them leading to permanent physical damage or even […]

Read more

Law & More: Episode 44 – Jennifer Bourke

Hong Kong, 24 September 2024: In the latest episode, we are delighted to meet Jennifer Bourke, the Consul General of Ireland to Hong Kong and Macao. With a busy schedule that mixes politics, business and culture, Jennifer is loving life in Hong Kong, where she embraces the city’s energy, works closely with the Irish community […]

Read more

Migrant worker issues ‘go back decades’

Hong Kong, 19 September 2024: Rogue middlemen continue to get away with exploiting imported workers in Hong Kong and stronger government regulation is needed to combat such behaviour, Colin Cohen has told radio listeners. Reacting to recent allegations of malpractice in the construction industry, he said: “These stories are not new and it is not […]

Read more