image

Cybersecurity

Mass exodus of staff at Hong Kong privacy commission since 2015 raises questions about management and operations

Commissioner Stephen Wong Kai-yi confirms 30 of his office’s 70 employees leaving since he took over, but he describes high turnover as normal

PUBLISHED : Monday, 21 May, 2018, 8:04am
UPDATED : Monday, 21 May, 2018, 9:07am

Hong Kong’s privacy watchdog has witnessed a mass exodus of staff since its current chief took office in 2015, with almost half including at least three section heads departing over the last two and a half years.

But Privacy Commissioner Stephen Wong Kai-yi denied that the high turnover had anything to do with his management, citing the exits as “normal personnel movements” motivated by personal circumstances or family reasons.

In a written reply to the Post, Wong confirmed 30 of his office’s 70 employees had left since August 2015, including 17 in 2016 and nine last year. He said the office now had 74 employees and no vacancies to fill.

“A high turnover rate has been a norm over the years since 2012 owing mainly to the fact that employment is contract-based and privacy officers are well sought after in the private and public sector,” Wong added.

The Office of the Privacy Commissioner for Personal Data noted that the average turnover rate for staff during the tenure of the past two commissioners was about 24 per cent from financial year 2005/06 to 2009/10, and 23 per cent from 2010/11 to January 2015. That would mean an average of 16 personnel leaving each year.

Two former senior officers who were among the 30 people who quit during Wong’s term said those who left had either resigned or decided against renewing their contract. One of the two, claiming to have direct knowledge of previous recruitment efforts, said 17 staff members leaving in one year was “very worrying” and could have affected the office’s operations.

The other former senior officer said Wong often told his subordinates he wanted his management style to be different from that of the previous commissioner, Allan Chiang Yam-wang, but that his approach had dented morale.

“The old way of doing things just doesn’t work any more,” the source quoted Wong as saying, and claimed this partly referred to how the office handled complaints.

A study by the Post found Wong had rotated staff away from their areas of expertise. For instance, Daniel Leung Chin-wah, head of enforcement and complaints, was made head of corporate support a year after Wong took up the top post.

One of the sources also said Wong’s personal assistant was assigned to the investigation team but resigned in dismay within half a year.

Hong Kong’s privacy commissioner to review data protection law after ‘major leaks’

Wong confirmed that three chief personal data officers had left since 2016. According to the commission’s annual report for 2015/16 – the financial year Wong took over – five of the office’s six divisions were chaired by chief personal data officers. But at present, only two were still working in the office.

On the question of reshuffling senior staff to different posts, Wong said the rotation would “enhance their exposure, and equip them with all-round knowledge and expertise necessary for more senior positions” as well as boost morale.

He explained this was “not uncommon among public organisations”.

Hong Kong privacy watchdog demands answers from Facebook on data security

Separately, Wong introduced an internship scheme in 2016. The Post understood the previous commissioner had decided against doing so because of the sensitivity of the data it handled.

The Post received an anonymous complaint that Wong had hired more than one intern without carrying out proper interviews. One former senior officer said he was unaware of any open recruitment exercises before he left.

Wong said in his reply that a total of 13 interns had been employed since 2016, and an open and proper recruitment procedure was in place, with jobs listed publicly in a variety of outlets. He stressed he did not know any of the interns beforehand or their parents.

“Interns were recruited and assigned to work in various divisions,” he said, including legal, compliance, policy and research, and communications and education.

Yet Wong made clear interns had “not been assigned” to work in law enforcement, nor were they involved in highly sensitive projects.

Law Yuk-kai, director of the Hong Kong Human Rights Monitor, noted the high staff turnover and said the Privacy Commissioner is duty-bound to explain the reasons for the departures, as it could affect its operation as a privacy watchdog.

Law said he would not speculate as to whether Wong’s management style led to the departure of key staff, but agreed rotating key staff members from investigation or enforcement role to other duties could affect staff morale.