Offence for disclosing personal data obtained without consent from the data user
Under the Personal Data (Privacy)(Amendment) Ordinance 2012 (“Amendment Ordinance”), with effect from 1 October 2012, a person commits an offence if he discloses personal data of a data subject obtained from a data user without the data user's consent (i) with the intent to obtain gain for himself or another person, or cause loss to the data subject or (ii) irrespective of his intent, the disclosure causes psychological harm to the data subject.
To explain the scope of these new offences, the penalties, and the types of defences recognized under the Amendment Ordinance, the Privacy Commissioner released an information leaflet on 27 September 2012. The information leaflet is written in a question and answer format and covers the following topics:-
In addition, the information leaflet also provides two hypothetical scenarios and suggests the courses of actions which can be taken in those situations.
The information leaflet can be found on the Office of the Privacy Commissioner for Personal Data's website at the following link: http://www.pcpd.org.hk/english/publications/files/offence_disclosing_e.pdf
Outsourcing the processing of personal data to data processors
The Privacy Commissioner recognizes that nowadays the trend of outsourcing and entrusting personal data processing work by data users to their agents is becoming increasingly common. The Amendment Ordinance contains amendments enhancing the protection of personal data in these circumstances by requiring data users who engage a data processor, whether within or outside Hong Kong, to process personal data on the data users' behalf, to adopt contractual or other means to (i) prevent personal data transferred to the data processor from being kept longer than is necessary for processing of the data; and (ii) prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to the data processor for processing. These amendments have come into force on 1 October 2012.
To provide data users with information on their new obligations when entrusting personal data to third parties for processing and how to comply with the new requirements, the Privacy Commissioner released an information leaflet on 27 September 2012.
The information leaflet covers the following main topics:-
The information leaflet can be found on the Office of the Privacy Commissioner for Personal Data's website at the following link: http://www.pcpd.org.hk/english/publications/files/dataprocessors_e.pdf