Skip to content

Media Statements

Media Statement

Date:6 March 2020

Privacy Commissioner Responds to Media Enquiries about Cathay Pacific Being Fined £500,000 by UK Information Commissioner’s Office

In relation to media enquiries about Cathay Pacific being imposed a maximum financial penalty of £500,000 by the Information Commissioner’s Office of the United Kingdom (ICO), the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) would not comment on the investigation, judgment and investigation results of data protection authorities in other jurisdictions in accordance with their laws. The PCPD can only make the following general observations and explanations pursuant to the Personal Data (Privacy) Ordinance (PDPO):

  • The PCPD completed an investigation of the relevant data breach incident in accordance with the law in 2019 and published an investigation report on 6 June 2019 (the report can be downloaded online: Same as in other cases, the PCPD would follow up on the remedial and corrective measures taken by the relevant organisation according to the instructions stated in the enforcement notice, to ensure effective implementation of improvement measures for personal data privacy protection.
  • Unlike the ICO, the Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner) is not empowered to impose any fine under the current PDPO. The PCPD has submitted proposals to the Government on legislative amendments. The proposals include:

i. Empower the Privacy Commissioner to impose administrative fines as an enhanced measure against violation of the Data Protection Principles;

ii. Raise the existing level of relevant fines under the PDPO to enhance deterrent effect.

  • In January 2020, the Government briefed the Panel on Constitutional Affairs of the Legislative Council on the direction of the legislative amendments, including the two proposals mentioned above. The PCPD is refining the proposals for the relevant legislative amendments for Government’s consideration.