Media Statements

Privacy Commissioner’s Response to Suspected Disclosure of Personal Data of
Government Officials, Legislators and Police Officers at
Online Discussion Forums and Instant Messaging Platforms 

• As at 5 pm today (19 July 2019), the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) received 315 related complaints and enquiries. 
   
• The Privacy Commissioner has already taken the initiative to contact the operators of the relevant social media platforms and online discussion forums and would continue to do so. The operators were requested to ask the netizens to delete the posts and stop posting such contents.  It was noted that most of the related contents have been removed.
   
• The Privacy Commissioner reiterated that everyone must respect others’ personal data privacy and obey and comply with the law. Similar disclosure and bullying acts may not only contravene Personal Data (Privacy) Ordinance (the Ordinance), but also incur civil and criminal liabilities.
   
• Any person disclosing (at online discussion forums, instant messaging platforms or publicly displaying) others’ personal data, no matter whether the data was obtained from the public domain, must consider whether the means of collection and use is legal and fair. If personal data is collected and disclosed for the unlawful purposes of bullying, incitement and intimidation, it is certainly illegal and unfair, and it contravenes the Data Protection Principles or requirements of the Ordinance.
   
• It should be noted that contravention of the Ordinance may constitute a criminal offence. Section 26 and 64 are two of the criminal offence provisions of the Ordinance:
  
  • Under section 26 of the Ordinance, a data user must take all practicable steps to erase personal data held when the data is no longer required for the purpose.
     
  • Contravention of section 26 of the Ordinance may attract a maximum fine of HK$10,000.
     
  • Under section 64(1) of the Ordinance, a person commits an offence if he discloses any personal data of a data subject obtained from a data user without the data user’s consent with the intention-
    • to obtain gain in the form of money or other property, whether for his own benefit or that of another person; or
    • to cause loss in the form of money or other property to the data subject.
       
  • Under section 64(2) of the Ordinance, a person will commit an offence if he discloses, irrespective of his intent, any personal data of a data subject obtained from a data user without the data user’s consent and the disclosure causes psychological harm to the data subject.
     
  • Contravention of section 64 of the Ordinance may attract a maximum fine of HK$1,000,000 and imprisonment for 5 years.
     
  • What amounts to contravention of section 64 of the Ordinance turns on all the relevant facts of each case and there is no generalisation. According to the legislative background and intent of the provision, the following are typical examples of the offence:
    • Sale by an employee of a company of customers’ personal data without the company’s consent, and for which he received payment from the purchaser.
    • Uploading of a celebrity’s intimate photos to the Internet by a staff of a laptop repair company, which he retrieved without authority from that celebrity’s laptop during repair, and causing psychological harm to the celebrity.
       
• Should anyone find his/her privacy rights relating to personal data are being abused, he/she may complain to the PCPD with supporting evidences.