A data breach is generally taken to be a breach of the security of the personal data
held
by a data user,
which results in exposing the data to the risk of unauthorised or accidental access,
processing, erasure, loss or use.
Depending on the circumstances of the case, the breach in question may amount to a
contravention of Data Protection Principle 4
of the Personal Data (Privacy) Ordinance (the Ordinance).
Although it is not mandatory under the Ordinance for data users to give data breach
notifications,
data users are encouraged to give such notifications timely to the Office of the
Privacy
Commissioner
for Personal Data (PCPD), the affected data subjects and other relevant parties when
a
data breach has occurred.
This notification form is for a data user to report a data breach to the PCPD and it
may
take about 10-15 minutes to complete.
You may refer to our “Practical Tips for Handling Data
Breach
Incident”
for more information.
If you find that your privacy rights relating to personal data are being abused or
there
is any possible
breach of the Ordinance which affects your personal data, please
go
here.
For general enquiries about the Ordinance and the work of the PCPD,
please go
here.
Personal Information Collection Statement
Please be advised that it is voluntary for you to supply to the PCPD your personal data. All personal data submitted will only be used for purposes which are directly related to this data breach notification and the exercise of the regulatory powers and functions of the Privacy Commissioner for Personal Data.
You have the right to request access to and correction of your personal data held by the PCPD. Request for access or correction of personal data should be made in writing to the Data Protection Officer at the address: 12/F, Dah Sing Financial Centre, 248 Queen’s Road East, Wanchai, Hong Kong.
The personal data submitted may be transferred to parties who may be contacted by the PCPD during the handling of this case including agencies who are authorised to receive information relating to law enforcement or prosecution.
Assessment of the incident and remedial actions taken