Date: 11 April 2017
Follow-up Actions by PCPD on the Reported Loss of Registration and Electoral Office’s two Notebook Computers Containing Personal Data of Registered Voters
The Office of Privacy Commissioner for Personal Data (“PCPD”) has made written submission to the Panel on Constitutional Affairs of Legislative Council on its action taken in connection with the reported loss by the Registration and Electoral Office (“REO”) of two notebook computers which contained personal data of registered voters. Since the commencement of compliance check on 28 March, the Privacy Commissioner for Personal Data (“Privacy Commissioner”) has followed up on the incident, in accordance with the Personal Data (Privacy) Ordinance (“the Ordinance”) and established procedures. Having met with REO officials on 10 April morning and considered the latest information obtained, the Privacy Commissioner has decided to commence an investigation, pursuant to section 38(b) of the Ordinance, to ascertain if there is any contravention of a requirement under the Ordinance. The PCPD has asked REO for further follow up enquiries and now awaits for REO’s response. Since the investigation is still ongoing, it would not be appropriate for PCPD to attend the Panel on Constitutional Affairs Special Meeting held today to comment on the incident or to divulge the content of investigation.
As at 5 p.m. today (11 April), the PCPD has received over 2,000 cases relating to the loss of REO’s notebook computers since 27 March, most of which came from a template with identical content. Some of those cases do not contain the name, contact means, etc. of the senders for the PCPD to follow up. The PCPD takes the public concern expressed in this incident seriously, and would continue to follow up.
The PCPD would continue to communicate with REO and computer security experts to evaluate the risk of data leakage.
The PCPD warned that the use of personal data kept in the register of voters for any purpose other than a purpose related to election is an offence under the relevant Electoral Affairs Commission Regulations.
-END-