Protection of Privacy

Hong Kong

Personal Data (Privacy) Ordinance, Cap. 486 is enacted in August 1995 and came into operation in December, 1996. It was an attempt to regulate the collection, use, accuracy and security of personal data. The Ordinance applies to both the public and the private sectors, of which the databases where the data is collected, held, processed or used in Hong Kong; or controlled by an entity whose principle place of business is in Hong Kong.

The Privacy Commissioner's Office (PCO) is an independent statutory body setting and governing the enforcement of the Ordinance. The Privacy Commissioner has recently issued guidelines for users of personal data on the Internet (see Appendix 5). The web sites should have their privacy policy statements either accessible or downloadable by their web users. The statement should set out the purposes for which the personal data will be used. If it is for direct marketing, an 'opt-out' choice should be given to the individual. To protect the data, encryption should be used for transmission of sensitive information, or provide a warning that transmission may be insecure.

A failure to comply with the guidelines may lead to a civil action for damages (including for injury to feelings) or a complaint to the Privacy Commissioner. In some cases, breach will constitute an offence. In other cases, the Commissioner may respond to a complaint by conducting an investigation and issuing an enforcement order. It would be an offence not to comply with that order.