Response to the loss
of medical data by Department of Health
1. In response to the loss of a USB flash drive carrying patients' personal data by the Department of Health, the
PCPD issued the following statement.
2. In accordance with Data Protection Principle 4 of
the Personal Data (Privacy) Ordinance ("the Ordinance"), all
practicable steps shall be taken to ensure that personal data held by a
data user are protected against unauthorized or accidental access,
processing, erasure or other use having particular regard to the kind
of data and the harm that could result if any of those things should
3. The PCPD has been informed of the case and has
contacted the Department of Health to see if its data handling
procedure and security measures are in compliance with the provisions
of the Ordinance; and to make recommendation to mitigate the harm to
the affected individuals, e.g. to inform them as soon as possible so
that they can stay alert.
4. The Privacy Commissioner for Personal Data Mr.
Roderick B Woo takes the opportunity to remind both the public and
private sectors to exercise particular caution when handling personal
data. Stringent handling procedure and sufficient security
safeguards should be implemented. In particular, when sensitive
personal data are stored or transmitted by electronic means, the data
shall be encrypted.
5. Contravention of a data protection principle is
not a criminal offence under the Ordinance. However, where the
Commissioner embarks on an investigation and at the conclusion of the
investigation he finds that the data user is contravening a requirement
under the Ordinance or has contravened such requirement in the
circumstances that make it likely that the contravention will continue
or be repeated, the Commissioner may serve an enforcement notice on the
data user to direct it to take necessary step to remedy the
contravention. If a data user fails to comply with the terms of the
enforcement notice, he then commits a criminal offence. Contravention
of an enforcement notice is an offence that could result in a fine at
Level 5 (at present $50,000) and imprisonment for 2 years.