Media Statements

Masks and Police Officers' Car Registration Numbers

The office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) has recently received complaints alleging that some organisations, shops and individuals collected excessive personal data in the course of distributing for free or selling masks to members of the public.  The PCPD has also received complaints about disclosure of police officers’ car registration numbers on online social media platform for the purposes of doxxing. The Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner), Mr Stephen Kai-yi WONG made the following responses:
 
Masks

• The Privacy Commissioner reminds members of the public to be cautious and vigilant about their own personal data when they collect or purchase masks.  They are advised to think twice whether certain personal data is entirely necessary to be provided.  As in the circumstances of any other transactions, members of the public should not rush into disclosing their personal data that is unrelated to and unnecessary for the transactions, e.g. ID card number, phone number, email address, family status, family members’ details and income.
   
• If individuals are fully notified of the purpose of collection and use of their personal data and they provide their personal data on a voluntary basis, they may not have a strong case to make a complaint about misuse of their personal data in the future.
   
• For organisations, shops and individuals engaged in distributing for free and selling of masks, they should collect the least amount of personal data in a lawful and fair manner, even if there is a practical need for so doing, for instance for the purposes of registration and compiling a waiting list.  As in the circumstances of any other transactions, providers of goods and services should not collect personal data that is unrelated to the transactions.  Neither should they use the personal data collected for other purposes without the consent of the data subjects.
   
• Unfair collection of personal data that is unrelated or disproportionate to the activities would not only violate the data protection principle of the Personal Data (Privacy) Ordinance (PDPO), it is also against data ethics.  If people take advantage of the circumstances of the outbreak of COVID-19 to collect and use the personal data collected without the data subjects’ consent for marketing of commercial products or to advance political publicity, that is exploitative and entirely not accepted under the law and prevailing ethical standards.
   
• The PCPD has received 12 related complaints and will follow up on them in accordance with the law.

 
Police Officers’ Car Registration Numbers

• The Privacy Commissioner condemns disclosure of police officers’ car registration numbers in pictures and postings on online social platform for the purposes of doxxing.
   
• The aforesaid doxxing activities involve disclosure of personal data of data subjects without the consent of the data user for the purposes of harassment and intimidation, causing psychological harm to the data subjects.  That certainly amounts to a criminal offence under section 64(2) of the PDPO.  Upon conviction, the maximum penalty is a fine of HK$1,000,000 and an imprisonment for 5 years.
   
• The aforesaid doxxing of police officers may also amount to a criminal offence under other relevant legislation.
   
• The PCPD has followed up on the incident, urging the operator of the online social media platform to remove the illegal doxxing contents and postings without delay.

 
Concluding Remarks

• The Privacy Commissioner calls on all sectors of the community to comply with the legal requirements and to respect and protect personal data privacy so that we can all be united and focused to combat the outbreak of COVID-19 in these critical times.