Time to give privacy watchdog real teeth
- Reports of data breaches in Hong Kong rose 22 per cent last year, and the investigating commissioner should be allocated more resources to bring those responsible to account
The erosion of privacy showed no sign of losing momentum last year, with a record number of personal data breaches. Many people may despair of keeping much real privacy any longer, but there is still room to better equip the watchdog concerned to fight back. It has a case for being allocated more resources from the government to counter the rise in data breaches attributable to mobile and social media technology. And it needs to be given more power to bring organisations and individuals to account for abuses.
Privacy Commissioner Stephen Wong Kai-yi received 129 data breach reports last year, up 22 per cent on 2017 and 80 per cent higher than in 2014. Two major violations remain under investigation. One involves the hacking of the personal information of 9.4 million Cathay Pacific Airways passengers, who were kept in the dark for seven months. The other involves a security flaw that allowed access to the details of 5.4 million local clients of a US-based consumer-credit reporting agency.
Law must be strengthened after Cathay Pacific data scandal
Admitting that he would have done better in response to these incidents with “more teeth, or teeth that could bite”, Wong says this justifies extra resources and powers. His proposals for a more effective regime include a 50 per cent increase in staff, a mandatory breach notification mechanism, including who to notify and when – relevant to the lax reporting of the Cathay case – how long data can be stored, data security and stronger penalties.
Funding and policy for the watchdog is the responsibility of the Constitutional and Mainland Affairs Bureau, whose spokeswoman said regular reviews had resulted in a 19 per cent rise in funding in the past five years. That is barely enough for the watchdog to stand still, let alone keep up with the explosion of data breaches. Indeed, only four formal investigations were launched, while the watchdog placed emphasis on compliance checks, promotion and education.
In considering his request for more teeth, officials can be expected to try to strike a balance between the interests of business – such as the free flow of information – and consumers. They should be mindful of Wong’s warning that without more enforcement powers his office would remain “enterprise friendly”. In that event expect privacy complaints to spiral.
