February 21 – The Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner) Mr Stephen Kai-yi WONG published an investigation report in accordance with section 48(2) of the Personal Data (Privacy) Ordinance (the Ordinance) on the incident of Hong Kong Broadband Network Limited (HKBN)’s inactive database having been intruded in mid-April 2018 (the incident) that caused leakage of personal data of about 380,000 customers and service applicants.  The investigation report was published after having considered that it is in the public interest to do so.  As contravention of relevant requirements under the Ordinance regarding personal data retention, erasure etc. was found in the investigation, the Privacy Commissioner decided to serve an enforcement notice on HKBN pursuant to section 50(1) of the Ordinance to remedy and prevent any recurrence of the contravention.

The report stated that at the time of the incident, HKBN stored customers’ data in three databases. The database in question was inactive, containing personal data of customers and service applicants as of 2012. The types of personal data included name, email address, correspondence address, phone number, Hong Kong Identity Card number and credit card information. About 380,000 individuals were affected. The investigation found that:

In light of the facts revealed and admitted by HKBN in the investigation, and in all the circumstances of the case, the Privacy Commissioner found HKBN to have failed to take all practicable steps to erase personal data stored in the database in question, where it was no longer needed, and retained, for an excessive period of time, personal data of former customers, contravening section 26 of the Ordinance (Data Erasure) and Data Protection Principle 2(2) of Schedule 1 to the Ordinance (Data Retention).

The Privacy Commissioner had served an enforcement notice on HKBN to remedy and prevent contravention. The Privacy Commissioner instructed HKBN to:

In the report, the Privacy Commissioner pointed out that currently there is no mandatory requirement for data breach notification under the Ordinance, whether to the regulatory authority or to data subjects. Notwithstanding this, HKBN had since the incident adopted the good practice of notifying the Privacy Commissioner and the affected customers, and had taken and promised to take remedial actions.  In addition, the Privacy Commissioner urged organisations to adopt an accountability approach in handling personal data by incorporating data governance, stewardship and ethics, namely being respectful, beneficial and fair, as part of corporate governance, and apply them as a business imperative throughout the organisation, starting from the boardroom.