First published: 22nd March 2008
In Letters to the Editor
I am so glad that Eugene R. Raitt and the Hong Kong Direct Marketing Association consider the existing Personal Data Privacy Ordinance "fine the way it is written" ("Privacy ordinance already gives people enough protection", March 12).
I am sure that is a great relief to all the people whose data was leaked from the Independent Police Complaints Council (IPCC) last year. I agree with privacy commissioner Roderick Woo Bun, that the ordinance needs to be reviewed and improved ("Why tougher privacy law is essential for HK", March 15). There are two major areas that should be updated - enforcement and exemptions.
Currently, the commissioner can issue enforcement notices against parties breaking the ordinance, and fines and imprisonment can only be imposed if the notice is ignored. Unfortunately, in the case of data leaks, the damage has already been done. No one was held responsible for the IPCC case. We should send a strong message to those who take care of our data that they have a responsibility to ensure its security. Our legislators were probably targeting organisational misuse of personal data when they wrote the ordinance, but the information society has empowered us all, including giving us the capability to misuse personal data in damaging ways. We should review the broad exemption for recreational and domestic purposes. It is probably reasonable not to burden home users with administration and record-keeping, but should personal data be left unprotected by the law, just because it was gathered for domestic or recreational purposes?
As a society, we must consider what we think is appropriate behaviour. For example, when someone picks up a lost memory card and finds it contains personal data, whether that is financial records or nude photos, should they try to return it to the owner or broadcast it to the world? Should we have laws that punish them for broadcasting this data? As we have seen from the recent nude photos cases and from the massive data leaks in the US and Britain, many people and organisations are processing, and sometimes mishandling, personal data. We need effective regulation of this.
Allan Dyer, Wong Chuk Hang