Commission says nothing done to stop personal information getting on internet The Privacy Commission yesterday laid the blame on the Independent Police Complaints Council (IPCC) in one of Hong Kong's largest personal data infringement cases affecting as many as 20,000 people. The commission, in a report released yesterday, accused the council of breaching the Personal Data (Privacy) Ordinance by not taking measures to prevent the leaking of complainants' confidential details to the internet by its outsourced IT contractor EDPS Systems. But the allegations were matched by an equally heated counter-attack from council members, who accused the commission of using them as a scapegoat in order to protect the IPCC Secretariat, an independent department staffed by civil servants. An outraged lawmaker yesterday vowed to move a motion urging the commissioner to relaunch the investigation. 'From the evidence before me, I do not find that IPCC had given any due consideration to ensuring security of the data,' Privacy Commissioner Roderick Woo Bun wrote in the report. 'There is no provision in the relevant contract imposing on the contractor the obligation to keep the personal data secure and confidential.' The commission, which issued an enforcement notice to the council this month requiring it to put a personal data protection policy in place, said the council had fulfilled the requirements in two weeks. The commission's seven-month investigation was triggered by a South China Morning Post report in March revealing the data leak on the china2easy.com website. The data contained the names, addresses and even criminal records of the people who had complained about the police. IPCC chairman Ronny Wong Fook-hum yesterday criticised the commissioner for failing to point out that the acts and defects identified in the report were those of the civil servants in the secretariat. 'The commissioner erred in law. He failed to have regarded that the acts at issue were committed by civil servants, and the government is prima facie liable for those acts under the ordinance,' he said. 'The commissioner avoided this issue and sought to place the burden as a matter of convenience on the council.' Mr Wong also criticised the commissioner for failing to give some council members an opportunity to be heard. Calling for a reopening of the investigation, Legislator James To Kung-sun said he was concerned about the independence of the commissioner. 'I could not believe that the blame has been so unfairly laid on the council members. It is so obvious that the government is the culprit,' he said. In response to the IPCC chairman's remarks, the privacy commissioner released a statement last night saying there was legal recourse available to the IPCC if it felt aggrieved by the findings. EDPS boss Ken Ng Kin said he was happy to see the report had cleared his company's name.