New Rules Could Make Firms Report Data Breaches

Hong Kong's privacy watchdog is to propose laws that would penalise companies if they fail to inform their customers of any data breaches.

This comes after a major controversy erupted in October last year when it was revealed that Cathay Pacific did not release information about a hacking of its database for months, even though millions of the airline's customers were affected.

Privacy Commissioner Stephen Wong said on Thursday that the watchdog is in the final stages of coming up with proposed changes to privacy laws and it plans to submit its proposals within the first half of this year.

This comes as the commission received 129 reports of data breaches last year, a new record that was up 22 percent from the previous year.

Wong said because his commission has been dubbed as a "toothless tiger" by some critics, he would like to see regulations that are more effective.

One proposal is to make it mandatory for data users to notify the commission, the affected persons and other relevant bodies, if there is a data leak. There could also be tough penalties if firms fail to do this.

The commission is also studying rules in some countries regarding how quickly such information must be conveyed.

Wong said the commission is aware that the proposed changes could be considered too stringent for some small and medium enterprises, or even to some multinationals.

The commissioner said he would not be "out of touch" with the actual circumstances of local organisations and would balance things out.

Wong said the rise in data breach cases was partly because some people, especially the younger generation, are rather careless with their personal information, and because they use more digital devices that store their data.

The watchdog said it received 1,890 complaints in total last year, up 23 percent from 2017. Of these, IT-related complaints more than doubled to 501 cases.