Many thanks for your enquiry.
Since the case is currently under investigation by another law enforcement agency, it will not be appropriate for our Office to comment on the case. We will nevertheless offer assistance to the relevant law enforcement agency in relation to personal data privacy issues as appropriate.
Meanwhile, the Privacy Commissioner would like to draw the attention of members of the public to the offence for disclosing personal data obtained without consent from data users under section 64* of the Personal Data (Privacy) Ordinance, Cap 486 of the Laws of Hong Kong, and the “Guidance on the Proper Handling of Customers’ Personal Data for the Banking Industry” and the “New Guidance on Direct Marketing” with a view to assisting the trade in understanding the requirements of the Personal Data (Privacy) Ordinance and good practices for handling customers’ personal data.
*Under section 64 of the Personal Data (Privacy) Ordinance, any person who discloses personal data without the consent of the data controller of such data (e.g., the banks in this case) with an intent to obtain financial gain or to cause financial loss to the data user is an offence with a maximum fine of HK$1 million and imprisonment for 5 years.