bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

helpersCheckIsPostiesArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

moreOnThisArticles

urlAlias

commentCount

sponsorType

authorLocations

authors

paywallTypes

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

socialHeadline

headline

flag

firstTopic

glossary

flattenTypeIds

publishedDate

additionalInfoBoxes

images

image

relatedLinks

relatedNewsletters

__typename

createdDate

sponsor

factSheets

series

knowledgeQuestion

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

copyrighted

customTimezone

liveContents

Ng Kang-chung

A long-awaited legislative reform to empower Hong Kong authorities to penalise companies over data breaches has been put on hold over concerns it might put a dampener on the local business environment, lawmakers have been told.
Secretary for Constitutional and Mainland Affairs Erick Tsang Kwok-wai said on Monday that the government could consider a “piecemeal approach” by first introducing minor improvements to minimise the impact on small businesses.
Tsang made the remarks while appearing alongside Privacy Commissioner Ada Chung Lai-ling at a meeting of the Legislative Council’s constitutional affairs panel.
Chung said her office had been studying amending the Personal Data (Privacy) Ordinance to give the watchdog more teeth.
Proposed major changes include empowering the privacy watchdog to impose administrative fines, making the reporting of data leak incidents mandatory, requiring companies to devise data retention policies and also increasing penalties.
“The law has been in place for 28 years and there has not been any change in the penalties,” Chung said.
“We have sought views from stakeholders and there are views that it should be done carefully amid the lukewarm economic climate.”
Spelling out the government’s position, Tsang said he appreciated it was the watchdog’s job to enhance the law to ensure greater privacy protections.
“But there are different views from different stakeholders that amid the prevailing economic situation, if companies, especially small and nano enterprises, are required to upgrade their systems or offer training to their staff, it will pose a certain extent of pressure on them,” he said.

The minister warned that if penalties were too harsh, it could place significant financial pressure on businesses.
“We need to strike a balance … We shall continue studying whether we should put forward smaller changes first or not,” he said.
“Our aim is that while enhancement of privacy protection can be achieved, it should not affect the operations of businesses, especially small businesses.”
Tsang stopped short of mentioning any time frame for the reforms, only saying the government would report back to the Legco once it had come up with more “concrete ideas”.
Legislator Carmen Kan Wai-mun said an update to the law was badly needed but agreed that a “piecemeal approach” was an acceptable option.
The law was last revised in 2021 to criminalise doxxing acts and give the privacy commissioner the relevant criminal investigation and prosecution powers.
The watchdog has initiated criminal investigations into 363 suspected doxxing cases as of the end of September.
Sixty-two people have been arrested in connection with investigations, with 38 people later charged and 28 of them convicted. The longest prison sentence handed among them was eight months.
But calls have mounted for more stringent reforms after the city witnessed a spate of data breaches in recent years.

The government-funded tech hub Cyberport had its servers compromised last year, leading to a leak involving the data of more than 13,000 users.
The privacy watchdog’s investigation into the incident found Cyberport staff had failed to take practicable steps to protect private information or promptly delete expired data.
Earlier this year, a large-scale data breach was reported at the South China Athletic Association, involving the loss of about 70,000 members’ personal information, including identity card numbers and passport details.
Local charity Oxfam Hong Kong suffered a cyberattack in July, exposing the personal data of more than 470,000 people, including their names, personal and email addresses, phone numbers, identity card numbers and payment details.
Tsang also told legislators that authorities planned to adopt more information technology systems to boost the efficiency of electoral procedures at next year’s Legco poll.
Highlighting vote counting as an example, Tsang said: “If results can come out sooner, it can also help ease the pressure on candidates.”
But he said there were no immediate plans to set up polling stations across the border to allow Hong Kong voters working or living in mainland China to cast their ballots remotely.


Hong Kong holds off sweeping privacy law revamp over concerns of impact on businesses

Hong Kong trade body hails liquor tax cut but some firms find little to cheer about

Hong Kong to cover up to 40,000 yuan in medical bills for some elderly in mainland care homes

Hong Kong’s HK Express fleet to reach 40 planes as airline lines up cut-price fares

Hong Kong economy

Calls for the reform of the city’s privacy law have mounted following a spate of data breaches in recent years. Photo: Shutterstock

Secretary for Constitutional and Mainland Affairs Erick Tsang has suggested implementing reforms on a piecemeal basis to ease the impact on small businesses. Photo: Jelly Tse

The government-funded tech hub Cyberport had its servers compromised last year, leading to a leak involving the data of more than 13,000 users. Photo: Jelly Tse

LinkedIn suspends collecting Hong Kong users’ data for GenAI: privacy watchdog

LinkedIn said in September its updated privacy policy included language that indicated users’ data and content would be used by default to train the platform’s GenAI. Photo: Shutterstock

The Privacy Commissioner for Personal Data earlier raised concerns about the social media platform’s default opt-in use of the data. Photo: Jelly Tse

Hong Kong’s privacy watchdog warns jobseekers against ‘blind’ ads to protect personal data

The entrance of the Office of the Privacy Commissioner for Personal Data in Wan Chai. Photo: Jelly Tse

Privacy Commissioner Ada Chung warns job applicants to look out for ads that fail to properly identify the prospective employer. Photo: Yik Yeung-man

Hong Kong urged to fast-track privacy law reforms amid surge in data breaches

The local branch of the charity Oxfam, which organises an annual hiking fundraiser, suffered a data breach that might have affected more than 470,000 people. Photo: Dickson Lee

Privacy Commissioner Ada Chung has said amendments to the privacy law are under discussion. Photo: Jelly Tse

The privacy watchdog has launched an investigation into a data breach at Oxfam Hong Kong. Photo: Jelly Tse

News

Hong Kong

Privacy watchdog says stakeholders feel stiffer penalties over data breaches ‘should be done carefully amid lukewarm economic climate’


Privacy watchdog says stakeholders feel stiffer penalties over data breaches ‘should be done carefully amid lukewarm economic climate’.


Legislative Council of Hong Kong

Cybersecurity

Crime in Hong Kong

Hong Kong politics