Case Notes

A bedding products company mandated online shoppers to consent to the use of personal data for direct marketing purposes... <more>

A government department posted a letter to an applicant’s obsolete address... <more>

A financial institution collected excessive personal data from outsourced staff without providing personal information collection statement and r... <more>

An online store sent invoices containing personal data to customers via unencrypted weblinks... <more>

Mobile Wi-Fi device rental company took inadequate security measures to protect customers’ personal data... <more>

Collection of copies of Hong Kong Identity Card and bank card from a job applicant by an employer prior to the acceptance of employment offer... <more>

Unencrypted documents containing personal data were sent to an incorrect email address... <more>

Restaurants took inadequate security measures to protect customers’ information – DPP 4 – security of personal data... <more>

Staff of a property management company disclosed the personal data of residents when using recycled paper – DPP 4 – security of personal data... <more>

A telecommunications company accepted a HKID Card that had been declared lost by a customer – DPP 4 – security of personal data... <more>

An employer posted a list containing the personal data of staff who were to undergo virus testing – DPP 4 – security of personal data... <more>

Staff of a public transport company was doxxed – section 64 of the PDPO – disclosure of personal data... <more>