Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

128 / 192

have contravened a requirement under the Ordinance “to remedy and, if appropriate,
prevent any recurrence of the contravention”.
9.22 In those cases where the contravention is attributed to a lack of or an inadequate
privacy policy, the Commissioner may in the enforcement notice direct the relevant
data user to take such steps to promulgate, amend or modify its personal data handling
policies or practices to prevent similar breaches from occurring.
9.23 The Commissioner views favourably a systematic approach by data users in
implementing a privacy management programme8 built upon a robust data privacy
policy and practices that are properly executed, reviewed and assessed by designated
data protection officer(s).
8 See Privacy Management Programme: A Best Practice Guide, available on the Website: