9th December 2024 – (Hong Kong) The Office of the Privacy Commissioner for Personal Data has uncovered a significant data breach involving the Electrical and Mechanical Services Department (EMSD), affecting over 17,000 individuals who were subject to compulsory testing during the pandemic. This incident, revealed in a report published today (9th December), highlights four major deficiencies in the EMSD’s handling of personal data, leading to a determination that the department violated the Personal Data (Privacy) Ordinance.
According to the report, from March to July 2022, the EMSD facilitated 14 compulsory testing operations, during which they procured and utilised an electronic form via a cloud platform to record personal details of individuals subjected to testing, including names, addresses, identity card numbers, and phone numbers. In April this year, the Privacy Commissioner received complaints from citizens who reported that their personal information could be accessed without requiring a username or password. The EMSD initially believed that the account on the platform would be deactivated and the data automatically deleted once the contract expired.
Privacy Commissioner Ada Chung Lai-ling condemned the EMSD for failing to establish written policies on data retention for personal information collected during compulsory testing. The department did not request the deletion of this data from the contractor, nor did it take proactive steps to delete the data or adequately follow up on its deletion—actions that clearly fell short of the requirements set forth in the Privacy Ordinance and failed to meet the public’s reasonable expectations.
The Privacy Commissioner has issued an enforcement notice to the EMSD, directing them to implement corrective measures to address these violations and prevent future occurrences. The EMSD has been given two months from the date of the enforcement notice to complete these actions.
, affecting over 17,000 individuals who were subject to compulsory testing during the pandemic.){kind=link}