Proposed enhancement of data privacy protection under the Personal Data (Privacy) Ordinance (the “PDPO”)

Sam Wu

Partner, Hong Kong

Beverly Fu

Associate, Hong Kong

The Office of the Privacy Commissioner for Personal Data, Hong Kong (the “PCPD”) oversees the enforcement of the Personal Data (Privacy) Ordinance (Chapter 486 of the laws of Hong Kong) (the “PDPO”), which protects individuals’ privacy in relation to personal data.

According to a recent meeting of the Panel on Constitutional Affairs on 19 February 2024 regarding background brief on the work of the PCPD, the PCPD is studying further amendments to the PDPO to enhance personal data protection.

The proposed amendments include establishing a mandatory data breach notification mechanism, requiring data users to have a data retention period policy and giving PCPD the power to impose administrative fines. The Panel on Constitutional Affairs will be consulted once a concrete proposal is formulated.

The summary below highlights some of the key aspects of the PDPO in relation to the proposed amendments advised by the PCPD.