Privacy Commissioner's Overview

A Decade of Personal Data Privacy Protection

This is my first annual report since I took office in August 2005. The Office of the Privacy Commissioner of Personal Data ("the PCPD") has been in operation now for almost a decade and it was apt that some organizational changes be made. To cope with rising office rentals, and to make the best use of the funds at our disposal, I made the decision to move our office to another location which is conveniently accessible to the public. To coincide with the removal a new logo was adopted which symbolizes the central purpose of our work more graphically. To achieve a higher degree of efficiency, accountability and transparency, we changed some of our internal administrative and accounting practices following a comprehensive review. More strategic changes are being planned. In this computerized era, large quantities of personal data can be transferred instantly on the Internet, and not a day passes by without the media reporting on some aspects of the many threats to privacy. With less than 50 staff, my Office is charged with the responsibility of protecting the personal data privacy rights of some seven million people. This is a daunting task, one that is made more so as the threats to such privacy rights become more pervasive and severe.

Mr. Roderick B. Woo, Justice of Peace Privacy Commissioner for Personal Data

My Office handled 14,156 enquiries and 972 complaints in the reporting year. The figures were close to the previous year, which reflects a well-established trend. In addition, 131 compliance checks were conducted, which amounted to a 38% increase on or over the preceding year. This reflects a renewed commitment on our part towards compliance in the face of persistent and increasingly serious lapses in data user privacy protection practices. In the coming year, I will deploy more human resources in the area of compliance and increase the number of random compliance checks. Organizations that collect and use large quantities of personal data will be our main target.

Part IV of the Personal Data (Privacy) Ordinance ("the Ordinance") empowers me to set up a register of data users. The register will offer a one-stop shop to data subjects interested in knowing more about what data users are doing with the personal data they collect. The registration system will require users to be open and honest in the way they manage personal data. Data users in selected classes will be the initial group to be subject to the new system. The public will be able to inspect the register free of charge.

Having been in force for almost 10 years, the Personal Data (Privacy) Ordinance is due for an extensive review. Currently we are engrossed in this task and I hope that the amendments we propose can be sympathetically considered by the Legislative Council in due course.

One of my essential functions is to promote awareness and understanding of the provisions of the Ordinance. During the year we conducted a range of educational activities involving the younger generation helping young people to understand at an early age the concept of personal data privacy. Next year, we will begin some industry-specific programmes aimed at offering some in-depth pragmatic guidance for data users.

Another of my statutory functions is to liaise and co-operate with my overseas counterparts in respect of matters of mutual interest. Hong Kong has the only independent Commissioner for Personal Data in the Far East and is certainly a leader in promoting personal data privacy awareness in the region. During the reporting year, I have participated actively in the work of bodies such as the Data Privacy Sub-group in the Asia-Pacific Economic Cooperation (APEC) and Asia Pacific Privacy Authorities (APPA) with whom we share a common objective in protecting personal data privacy rights. Mindful of the need to seek solutions to global issues I have kept contact with Commissioners in Europe, North America and the rest of the world. All these activities and networking will also prepare my Office for the day when provisions of Section 33 of the Ordinance shall become operative.

As a regulatory body there is much work to be done as we enter the next decade of our existence. I am strongly committed to the ideals upon which this Office was founded, and I pledge to strengthen personal data privacy protection in Hong Kong by all expedient means. In this I know I shall have the continued support of the community which we serve.

Roderick Woo
Privacy Commissioner for Personal Data