Skip to content

Something urgent? Call us now! (852) 3416 1711

First cybersecurity law in pipeline

By Claire Chow

Hong Kong, 3 July 2024: Authorities are paving the way for Hong Kong’s first cybersecurity legislation, seeking to regulate the protection of computer systems in sectors which are essential to the smooth running of the city. Operators of such systems will be required to ensure their integrity and reliability, while a new Commissioner’s Office will oversee the regime and ensure implementation. Significant fines may be imposed on organisations which fail to comply.

The measures are contained in the Protection of Critical Infrastructure (Computer System) Bill, details of which were given to the Legislative Council’s Panel on Security this week. A month-long public consultation is imminent, with the bill expected to be brought before the full LegCo by the end of this year.

So-called critical infrastructures (CIs) are the facilities necessary for the maintenance of normal functioning of society, such as financial institutions, healthcare systems, telecoms services, power supplies and transport networks. The computer systems at the heart of these need safeguarding from breakdowns or cyberattacks.

There have been numerous incidents overseas in which major institutions or corporations have been seriously disrupted by hackers. In 2021, a fuel pipeline operator suffered a ransomware attack that hindered nearly half the fuel supply on the US east coast. Earlier this year, a data centre in Sweden was attacked by hackers, disrupting government operations.

Synnovis (NHS England’s pathology services provider) was also subject to a ransomware attack by Qilin (the Russian cyber-criminal group) only last month in which thousands of hospitals and appointments were disrupted. Publication of the stolen data included patient names, NHS numbers and blood test descriptions. The incident also forced the NHS to issue an urgent message to people with universal blood types to donate as the attack affected hospitals’ ability to match patients’ blood.

Here in Hong Kong, medical services were similarly affected by a recent ransomware attack on the computer system of Union Hospital, though the hospital has stated that no leakage of patient data was found.

The government is proposing two categories of CIs. First, those delivering essential services in eight sectors: energy, IT, banking and financial services, land transport, air transport, maritime, healthcare, and communications and broadcasting. Second, those maintaining important societal and economic activities such as major sports and performance venues, research and development parks, and the like.

The proposed regime will apply only to designated CI operators (CIOs) – in other words, large organisations and institutions – and then only to their critical computer systems. In line with similar legislation in other jurisdictions, the identities of CIOs will not be made public in order to shield them from becoming potential attack targets.

Essential services provided by the government, such as water supply and drainage relief, are not covered by the bill. These will remain regulated via an administrative approach under the internal Government Information Technology Security Policy and Guidelines.

Once designated by the Commissioner’s Office, CIOs will be required to: appoint a dedicated team with professional knowledge to manage cybersecurity; formulate and carry out a computer system security management plan and submit it for scrutiny; conduct a computer system security risk assessment once a year and undergo an independent audit every two years. Further, CIOs will be obligated to take part in a computer system security drill organised by the Commissioner’s Office every two years.

In the event of extremely serious security issues, CIOs must notify the Commissioner’s Office within two hours. Lower-level security incidents should be reported within 24 hours. It is proposed that fines for non-compliance with any aspect of the new regime should range from HK$500,000 up to HK$5 million, with additional daily fines in the event of continuing breaches. It is also worth noting that while some companies outsource IT operations or management to third-party contractors, CIOs will ultimately be liable.

In conclusion, the new cybersecurity legislation should be viewed as essential in protecting the core facilities that keep Hong Kong running smoothly. Clearly, cyberattacks can have serious and life-threatening consequences. We await with interest the final version of the bill, which will give potential CIOs a clearer picture of their obligations. In the meantime, organisations likely to be designated as such are strongly advised to review their existing cybersecurity arrangements and prepare for the new regime.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.

39+ years of legal experience is just a click away.

Friendly and approachable, we are ready to answer your questions and offer you sound advice.

Contact us now

BC&C-contact-us

News & Knowledge

Learn more about what we do and what we say. Subscribe to our newsletter to ensure you receive our updates.

  • This field is for validation purposes and should be left unchanged.

Updating copyright for the AI landscape

By Susan Cheung and Nicole Chin Hong Kong, 7 October 2024: The Commerce and Economic Development Bureau and the Intellectual Property Department have jointly published a consultation paper, taking a significant step towards modernising Hong Kong’s copyright regime in response to the rapid advancements in artificial intelligence (AI). The paper addresses key issues regarding copyright […]

Read more

Ian McWalters delivers compelling talk

Hong Kong, 2 October 2024: A large audience gathered at the University of Hong Kong to hear former Justice of Appeal Ian McWalters deliver the sixth annual HKU-Boase Cohen & Collins Criminal Law Lecture. His talk, “The Exercise of Discretion in the Criminal Justice System”, examined discretionary decision making by law enforcement, prosecutors and judicial […]

Read more

The blurred lines of ‘medical beauty’

By Teresa Leung Hong Kong, 25 September 2024: Our city’s largely unregulated “medical beauty” industry is back in the news following the jailing of a beautician over a botched botox injection. It is the latest in a string of cases featuring unlicensed medical practices – some of them leading to permanent physical damage or even […]

Read more

Law & More: Episode 44 – Jennifer Bourke

Hong Kong, 24 September 2024: In the latest episode, we are delighted to meet Jennifer Bourke, the Consul General of Ireland to Hong Kong and Macao. With a busy schedule that mixes politics, business and culture, Jennifer is loving life in Hong Kong, where she embraces the city’s energy, works closely with the Irish community […]

Read more

Migrant worker issues ‘go back decades’

Hong Kong, 19 September 2024: Rogue middlemen continue to get away with exploiting imported workers in Hong Kong and stronger government regulation is needed to combat such behaviour, Colin Cohen has told radio listeners. Reacting to recent allegations of malpractice in the construction industry, he said: “These stories are not new and it is not […]

Read more