Skip to content

有紧急法律疑难?请立即致电 (852) 3416 1711 与本行联系。

Data security: time to review

By Claire Chow

Hong Kong, 3 February 2023: Two personal data leaks by Hong Kong’s electoral office – both caused by human error – have highlighted the importance of cyber security and information protection in the digital age. Businesses and organisations should take note and review their safety mechanisms accordingly.

An investigation by the Office of the Privacy Commissioner for Personal Data found the government’s Registration and Electoral Office (REO) had breached regulations and failed to protect voters’ information. The REO had not taken “all practicable steps” to ensure such details were shielded from unauthorised access, according to the Privacy Commissioner’s report.

In the first incident, during Hong Kong’s fifth wave of Covid-19 infections in March last year, a clerical officer tried to send two spreadsheets with the names and addresses of some 15,000 voters to her personal email so she could work from home the next day. But she typed in the wrong email address and the files went to an unknown recipient.

The following month, during preparations for the Chief Executive election, another REO employee mistakenly attached a reply slip containing details about an Election Committee member when sending a test email to 64 other members or their assistants.

In her investigation, Privacy Commissioner Ada Chung found the first incident stemmed from the officer’s negligence and lack of awareness of the REO’s own guidelines, which stipulated “[staff should] only use the email system of the REO for transmission of classified information through email” and “[staff should not] use personal email accounts for official duties or for transmitting classified information or personal data”. Ms Chung also found the REO had not put in place appropriate information security measures.

The second breach was down to collective negligence and lack of awareness by several staff members and deficiencies in the REO’s workflow, according to the Privacy Commissioner. While working long hours and under pressure to meet deadlines, employees had resorted to last-minute manual checking, thus increasing the risk of human error.

Ms Chung noted: “The two incidents revealed that the Registration and Electoral Office had not taken all practicable steps to ensure that personal data was protected from unauthorised or accidental access, processing, erasure, loss or use.” She concluded the REO had contravened the Personal Data (Privacy) Ordinance. The REO was served with two Enforcement Notices and has since enhanced security measures, including monitoring of its email system, and reviewed workflow procedures.

Concluding her report, Ms Chung provided businesses and organisations with the following recommendations for handling personal data:

  • Thoroughly implement a personal data privacy management programme;
  • Conduct privacy risk assessments and formulate specific guidelines for non-routine work;
  • Devise effective education and training plans on personal data security; and
  • Deploy information security measures to mitigate the risk of human errors.

In conclusion, it should be noted that the digital age is a double-edged sword. While it has brought countless ingenious solutions for processing information, this also means greater threats in terms of cyber security. Personal data loss may include financial, personal and health information.

Such breaches can have devasting consequences for all parties. For an individual, their privacy and security are compromised. For a business or organisation, there are legal, financial and reputational implications. For these reasons, and as highlighted by the REO examples, it is obvious that compliance with relevant data protection laws and robust cyber security measures are in everyone’s best interest.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Criminal Matters, Civil and Commercial Litigation, and Intellectual Property. She can be contacted at Claire@boasecohencollins.com.

按此了解本行逾39年的专业法律经验。

本行的律师团队友好亲切、平易近人,乐于解答您的疑问,并为您提供合理的建议。

联系我們

BC&C-contact-us

新闻及知识

了解更多關于本行的工作和其他咨询。订阅本行的企业通讯,以确保您收到我们的最新消息。

  • 这个字段是用于验证目的,应该保持不变。

Bill brings choice to end-of-life care

By Alex Liu Hong Kong, 3 December 2024: A new law that […]

Read more

HKU seminar examines career development

Hong Kong, 25 November 2024: Our Consultant John Zhou w […]

Read more

Beauticians and their duty of care

By Teresa Leung Hong Kong, 20 November 2024: Can you su […]

Read more

Carrian saga provides a trip back in time

Hong Kong, 19 November 2024: The biggest corporate corr […]

Read more

Old habits and an escalating problem

Hong Kong, 13 November 2024: In a fast-moving world, Ak […]

Read more