bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

paywallTypes

createdDate

publishedDate

sponsorType

urlAlias

moreOnThisArticles

commentCount

authorLocations

authors

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

articleSpeeches

socialHeadline

headline

images

flag

firstTopic

glossary

flattenTypeIds

image

relatedLinks

relatedNewsletters

__typename

sponsor

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

SCMP Reporter

Only seven of 30 incidents reported to privacy commissioner and police
The personal data of more than 46,000 people have been leaked by the government and government-funded  bodies in the past three years, but the privacy watchdog was notified of less than a quarter of the 30 incidents involved.
Public organisations accounted for 16 instances, which exposed confidential details of about 44,000 people since May 2005. Government departments were responsible for leaking details of 1,900 people in 14 cases.
The  information, made public by Secretary for Commerce and Economic Development Frederick Ma Si-hang  yesterday, did not include the latest blunder in which classified police files with details of officers, witnesses and suspects were found on the internet earlier this week.
But the estimates did include the leaking on the internet of confidential immigration files  this month.
Mr Ma said only seven incidents had been reported to the privacy commissioner and police.
'The government takes these leak cases seriously and we are absolutely not satisfied with them,' he said. 'But data users are not obliged to report the leakage to the privacy commissioner under the  ordinance.'
As for the remaining 23 cases, Mr Ma said the  government departments and public bodies had 'suitably reported to the relevant parties'.
The Constitutional and Mainland Affairs Bureau revealed that  11 government departments and six public bodies were involved in the 30 leak cases. Among them, the Food and Environmental Hygiene Department had accounted for three cases, while four tertiary institutions had reported five cases.
The Hospital Authority had received 10 reports of losses of electronic devices from six hospitals or clinics  in the past two months. It is estimated the devices contained the data of 16,000 patients.
About 20,000 people who complained about the police over the past decade also found their names, addresses and identity card numbers available on the internet after a leak by the Independent Police Complaints Council in March 2006.
A spokeswoman of the Office of the Privacy Commissioner said a responsible organisation should report the data leak particularly when it involved a substantial amount of sensitive personal data.
'We can give professional advice to data users to minimise the negative consequences of the leak,' she said.
Referring to the recent series of leaks, Mr Ma said the government would review information security policies, guidelines and other  measures in the next three to four months.
'Instead of system loopholes, we find that most cases involve inadequate awareness of our colleagues while sometimes the guidelines are not fully adhered to,' he said.
Lawmaker James To Kun-sun,  vice-chairman of the Legislative Council security panel, said the recent leaks had developed into an information security disaster and urged an independent investigation.
The government should  also legislate to require all departments and public bodies to report their leak cases to the privacy commissioner, he added.



Data of 46,000 leaked over three years