First published: 28th July 2012
A trial scheme to test Hong Kong school students for drugs has been criticised by the Privacy Commissioner for Personal Data, Allan Chiang Yam-wang.
The testing was performed by the Security Bureau's Narcotics Division and the Education Bureau, but they did not conduct a privacy impact assessment. Mr Chiang also highlighted problems in the protocols for handling the students personal data set by the Bureaus, including not stating how long the data should be retained, and not adequately protecting the data that was stored on a USB flash drive. The drive was password protected, but the password was stored with the drive. Teachers processed the data on their personal computers, but received no guidance on how to safeguard the data.
A spokesman for the Narcotics Division said that the protocol has already been revised, including requiring all computers storing students' data to shut down internet connections.
A wider question remains. Teachers routinely process personal data concerning their students, and some of it may be as sensitive, or more sensitive than drug test results. Do teachers has adequate training and resources to protect this personal data? Without proper training, teachers might easily misunderstand protocols - an internet connection is forbidden, but they might use a connection to a LAN (with an internet gateway) without realising the consequences, or may overlook that their laptop has silently connected to WiFi.
A piecemeal approach to personal data protection - one policy for drug test results, another for exam results, and so on - will increase the burden on teachers, and may introduce conflicting requirements, perhaps one protocol demands no internet connection, and another a secure connection to a server.