Privacy Commissioner Releases New Information Leaflets on the Personal Data (Privacy)(Amendment) Ordinance 2012

Offence for disclosing personal data obtained without consent from the data user

Under the Personal Data (Privacy)(Amendment) Ordinance 2012 ("Amendment Ordinance"), with effect from 1 October 2012, a person commits an offence if he discloses personal data of a data subject obtained from a data user without the data user's consent (i) with the intent to obtain gain for himself or another person, or cause loss to the data subject or (ii) irrespective of his intent, the disclosure causes psychological harm to the data subject.
To explain the scope of these new offences, the penalties, and the types of defences recognized under the Amendment Ordinance, the Privacy Commissioner released an information leaflet on 27 September 2012. The information leaflet is written in a question and answer format and covers the following topics:-

1. What kind of acts will be caught under the offence?
2. Is monetary gain or loss required for the offence?
3. What if the act is not intended to lead to gain or loss but the data subject was humiliated as a result of the disclosure of his personal data?
4. Will normal journalistic activities be affected by the offence?
5. Will normal and innocuous browsing activities of web-users be affected?

In addition, the information leaflet also provides two hypothetical scenarios and suggests the courses of actions which can be taken in those situations.

The information leaflet can be found on the Office of the Privacy Commissioner for Personal Data's website at the following link: http://www.pcpd.org.hk/english/publications/files/offence_disclosing_e.pdf

Outsourcing the processing of personal data to data processors

The Privacy Commissioner recognizes that nowadays the trend of outsourcing and entrusting personal data processing work by data users to their agents is becoming increasingly common. The Amendment Ordinance contains amendments enhancing the protection of personal data in these circumstances by requiring data users who engage a data processor, whether within or outside Hong Kong, to process personal data on the data users' behalf, to adopt contractual or other means to (i) prevent personal data transferred to the data processor from being kept longer than is necessary for processing of the data; and (ii) prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to the data processor for processing. These amendments have come into force on 1 October 2012.

To provide data users with information on their new obligations when entrusting personal data to third parties for processing and how to comply with the new requirements, the Privacy Commissioner released an information leaflet on 27 September 2012.

The information leaflet covers the following main topics:-

1. The meaning of "data processor"
2. Obligations of data users
3. How to comply with the requirements
4. Good practice recommendations
5. Redress of data subjects

The information leaflet can be found on the Office of the Privacy Commissioner for Personal Data's website at the following link: http://www.pcpd.org.hk/english/publications/files/dataprocessors_e.pdf

Key Contacts

Cynthia Chung

Partner | Corporate Commercial | Employment and Pensions

Email or call +852 2825 9297