In Alignment with the National 15^th Five-Year Plan
Privacy Commissioner’s Office and Digital Policy Office Jointly Organise Briefing Session on the
Safeguarding Personal Data AI Sandbox

In alignment with the National 15^th Five-Year Plan that encourages exploration of new regulatory measures such as regulatory sandboxes, the PCPD and the Digital Policy Office (DPO) launched the Safeguarding Personal Data AI Sandbox (Sandbox) for primary and secondary schools this July. A briefing session was conducted by the Hong Kong International Data Privacy Academy (Academy) earlier (28 August) on the Sandbox to introduce to the education sector the application procedures and the operation of the Sandbox. The briefing session was very well received, attracting nearly 300 principals and teachers from primary and secondary schools.
 
At the briefing session, Privacy Commissioner Ms Ada CHUNG Lai-ling introduced the objectives, scope, application requirements and assessment criteria of the Sandbox, and shared the guidance materials on privacy protection in the use of artificial intelligence (AI) published by the PCPD. The Assistant Commissioner (Data Applications) of the DPO, Mr Brian SUN Yue-man, highlighted the key features of AI governance with reference to the “Ethical Artificial Intelligence Framework” and the “Hong Kong Generative Artificial Intelligence Technical and Application Guideline”.   
 
In addition, the Director of Smart City & Digital Transformation of the Hong Kong Cyberport (Cyberport), Mr Ricky CHOI Wai-kit, the General Manager of the Digital Trust and AI Transformation Division of the Hong Kong Productivity Council (HKPC), Mr Cola LAM Ho-lok and the Head of the HKPC Academy, Ms Cherry LEE Wai-yin, shared their practical experience and advice on information security considerations when adopting AI solutions, as well as on selecting AI solutions that best meet teaching and learning needs.
 
To assist schools in understanding the nature and functions of different AI-enabled education tools, the PCPD and the DPO will organise a Sandbox Roadshow at Cyberport 5 on 6 October at 2:30pm. Participating AI solution providers will showcase a variety of AI solutions and conduct live demonstrations, providing schools with an opportunity to explore various AI tools that support teaching, learning and school administration.
 
Interested schools may visit https://www.pcpd.org.hk/english/artificial_intelligence/index.html for details of the Sandbox.

Privacy Commissioner’s Office
Organises “Hong Kong’s First Five-Year Plan” Seminar Series
to Help Advancing High-Quality Development of Hong Kong

The Academy, under the auspices of the PCPD, will be organising the “Hong Kong’s First Five-Year Plan” Seminar Series (Seminar Series). The Seminar Series will focus on key topics such as privacy protection in AI, data security and cross-boundary flows of personal information, with a view to supporting the medium-to long-term development strategies set out in the “First Five-Year Plan for Economic and Social Development of the Hong Kong Special Administrative Region (2026 – 2030)” (Hong Kong’s First Five-Year Plan) and complementing the implementation of relevant policy measures. The Seminar Series seek to further deepen understanding of the relevant issues among different sectors of society and fully align with the objectives of the National 15^th Five-Year Plan, thereby facilitating the society to jointly advance Hong Kong’s high-quality development.
 
The Seminar Series will be officially launched in early October. The inaugural session will be an internal briefing for PCPD staff members, enabling them to gain an in-depth understanding of the overall framework, strategic priorities and far-reaching implications of Hong Kong’s First Five-Year Plan for the city’s future development. The internal briefing will also cover the contents of the Honourable Chief Executive’s 2026 Policy Address. It aims to further strengthen staff members’ understanding of the development directions of both the Country and Hong Kong, and to facilitate the integration of relevant policies into various aspects of the PCPD’s work, thereby enabling the PCPD to better serve the public and enhance their well-being.
 
Starting from October, the Academy will organise a series of public talks and seminars in the form of, for instance, “Dialogues with Experts” and “Topical Seminars”. Distinguished experts and academics from relevant fields will be invited as guest speakers to discuss the opportunities and challenges arising from innovation and technology development, data governance and smart city development under Hong Kong’s First Five-Year Plan. The first public event will be the seminar entitled “Agentic AI: Driving Innovation and Safeguarding Personal Data Privacy”, tentatively scheduled for late October. Further details will be announced in due course.

PRIVACY 101

Navigating Children’s Privacy Challenges in the Age of AI

The rapid advancement of digital technologies is transforming the education landscape. As schools increasingly incorporate AI-enabled tools into teaching and learning, students are benefitting from more interactive, personalised and accessible educational experiences than ever before.

 

However, alongside these opportunities, this also comes with a growing responsibility for schools, teachers and parents to safeguard children’s privacy in an increasingly AI-driven world. Whether participating in virtual lessons, using AI-powered learning applications or engaging on online platforms, children may be exposed to privacy risks if personal data is shared without appropriate awareness or safeguards. Against this backdrop, schools, teachers and parents play a pivotal role in helping children navigate the digital world safely and responsibly. The following practical tips can help foster a more privacy-conscious digital environment for children:

1. Stay involved in children’s online activities: Teachers and parents are encouraged to find suitable ways to engage with children in their online activities and openly discuss the “do’s and don’ts” of online behaviour, as well as how to use the Internet safely;

2. Utilise parental controls: Parents should consider using parental controls offered by online platforms and applications to monitor children’s online activities in order to protect them from undesirable content or contacts;

3. Examine privacy settings: Personal data on many online platforms is set by default to be “shared with everyone” instead of being “restricted”. Parents and teachers should guide children in examining and configuring the privacy settings critically before using new platforms;

4. Heighten children’s vigilance on digital footprints: Children should be reminded not to rush to provide or share personal data, such as photos, education history and location trails, when registering for or using online platforms, even if the information appears to be indirect or fragmented;

5. Cultivate respect for others’ privacy: Teachers and parents should encourage children to respect others’ privacy in the same way they would like their own privacy to be respected. In practice, children should seek consent before sharing or tagging photos of friends and family members online; and

6. Use AI tools prudently: As digital tools like AI chatbots become more prevalent, parents and teachers should provide children with guidance on safe interactions with AI tools. This includes reminding children to refrain from sharing their own and others’ personal data and prompt AI chatbots to provide age-appropriate responses.

For further guidance, please refer to the “Safeguarding Children’s Online Privacy – Practical Tips for Parents and Teachers”.

 

In addition, primary and secondary schools seeking to explore the adoption of AI technologies with the support of regulatory guidance on personal data privacy protection and technical advice are encouraged to apply for the Sandbox, jointly launched by the PCPD and the DPO, with application deadline on 30 October.

 

PRIVACY COMMISSIONER’S FINDINGS

Inadvertent Disclosure of Students’ Personal Data via Email by a University

Background

A faculty staff member intended to email the faculty’s non-local students about the university’s quarantine arrangements. However, when retrieving the email addresses of the non-local students from the faculty’s master list of students, the staff member mistakenly attached the master list in the email.

 

The master list contained names, dates of birth, nationalities, email addresses, correspondence addresses and contact numbers of about 2,500 students of the faculty. As a result, the personal data was unnecessarily disclosed to the recipients of the email concerned. The university reported the incident to the PCPD.

Remedial Measures

The university now requires all outbound emails containing personal data be checked by another staff member before they are sent. Besides, work files containing personal data, for example, the master list, must be encrypted.

 

Lessons Learnt

Universities possess a large volume of students’ personal data and should therefore take reasonably practicable measures to ensure that staff handling such data are properly trained. Staff should observe relevant personal data privacy policies and exercise due diligence in applying those policies. Universities should establish procedures to ensure staff’s compliance with those policies.

TECH TALK

Staying Connected, Staying Protected: Privacy Tips for Social Network Users

Online social networking sites have become an integral part of daily life, enabling users to stay connected with friends, build networks of like-minded individuals and interact with communities that share common hobbies and interests. When used responsibly, social networking platforms can provide valuable opportunities for communication, connection and collaboration. However, interactions in the online world may also expose users to privacy threats such as cyber-stalking, identity theft and social engineering attacks if adequate precautions are not taken.

 

To enjoy the benefits of social networking while protecting your personal data privacy, keep the following do’s and don’ts in mind:

 

Do’s for Safe Social Networking

• Set strong passwords for your social networking accounts and enable multi-factor authentication (MFA) and login notifications whenever available;
  
• Consider using separate email accounts for registration on a social networking site and for your personal communications;
  
• Keep your online network only to people you genuinely know and trust; and
  
• Read the privacy policies of social networking sites to understand how they collect, use and share your personal data with external parties.

Don’ts that Put Your Personal Data Privacy at Risk

• Don’t post personal data such as your address, date of birth, personal IDs, telephone numbers, credit card numbers or your daily routine;
  
• Don’t click on suspicious links or attachments that appear to be sent from your friend list as fraudsters might impersonate your friends or acquaintances to send over malicious content or direct you to fraudulent websites; and
  
• Don’t keep unused accounts indefinitely. If you no longer need an account which contains your personal data, deactivation may not be sufficient. Consider submitting a request to the official website for account deletion.

WHAT’S ON

Reporting to Legislative Council – Secretary for Constitutional and Mainland Affairs and Privacy Commissioner Attend Meeting of the Legislative Council Panel on Constitutional Affairs

The Secretary for Constitutional and Mainland Affairs (SCMA), Miss Jance TSE Siu-wa, GBS, JP, attended the Policy Briefing meeting of the Legislative Council (LegCo) Panel on Constitutional Affairs on 23 September to provide briefing on Hong Kong’s First Five-Year Plan and the 2026 Policy Address. Privacy Commissioner Ms Ada CHUNG Lai-ling also attended the meeting to answer questions raised by LegCo members on the protection of personal data privacy and the work of the PCPD.

 

During the meeting, in response to a LegCo Member’s question on promoting data integration within the Guangdong-Hong Kong-Macao Greater Bay Area (GBA), the Privacy Commissioner stated that the PCPD has consistently supported the secure and orderly flow of data, including personal data, within the GBA. The PCPD has been providing advice to relevant policy bureaux and departments on the matter to ensure compliance with the Personal Data (Privacy) Ordinance (PDPO), and has published guidance materials on cross-border/cross-boundary transfers of personal data.

 

The Privacy Commissioner also stated in the meeting that the Standard Contract for the Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong) (GBA SC), formulated by the PCPD together with the relevant policy bureau and the Cyberspace Administration of China, has been operating very smoothly. The GBA SC serves as a facilitation measure for cross-boundary flow of personal information in the GBA.

 

Please click here for the paper provided by the Constitutional and Mainland Affairs Bureau to the LegCo Panel on Constitutional Affairs.
Please click here for the opening remarks of the SCMA (Chinese only).

Promoting Privacy Protection in AI – Privacy Commissioner Speaks at the 10^th Asian Privacy Scholars’ Network Conference

Privacy Commissioner Ms Ada CHUNG Lai-ling attended the 10^th Asian Privacy Scholars’ Network Conference (Conference) on 24 September and delivered a keynote address. The Conference was co-organised by the Centre for Legal Innovation and Digital Society of the Faculty of Law of the Chinese University of Hong Kong (CUHK) and the Asian Privacy Scholars Network. The PCPD was a supporting organisation of the Conference.
 
In her keynote address titled “Ensuring both Development and Security: Advancing Responsible AI through Protecting Privacy”, the Privacy Commissioner highlighted the “Global AI Governance Initiative” of the Country and pointed out the importance of pursuing AI innovation while maintaining security, as reaffirmed in Hong Kong’s First Five-Year Plan and the Honourable Chief Executive’s 2026 Policy Address. She also elaborated on the PCPD’s work in promoting the safe and responsible use of AI through ensuring compliance, communication, and collaboration at both local and international levels.
 
Please click here for the Privacy Commissioner’s presentation deck.

PCPD 30^th Anniversary – Hong Kong International Data Privacy Academy Organises a Public Seminar on Fraud Prevention

In celebration of the 30^th anniversary of the PCPD, the PCPD has been rolling out a series of educational and promotional initiatives. A public seminar entitled “Preventing Online Scams and Staying Safe on Messaging App and Social Media”, organised by the Academy, was successfully held on 15 September. Supported by Meta, the seminar attracted over 400 participants.

 

At the seminar, Privacy Commissioner Ms Ada CHUNG Lai-ling shared some fraudulent cases involving WhatsApp hijacking and other common online scam cases, as well as some anti-fraud tips with the participants. Ms Maggie TAM, Head of Public Policy, Hong Kong, Meta, also introduced to the participants Meta’s anti-scam measures across its platforms, including WhatsApp’s safety and security features, as well as its parental supervision tools and safeguards for teen accounts.

 

Please click here for the Privacy Commissioner’s presentation deck (Chinese only).

Building National Cybersecurity – Privacy Commissioner Attends 2026 China Cybersecurity Week Events

In support of the annual China Cybersecurity Week, Privacy Commissioner Ms Ada CHUNG Lai-ling attended the 2026 China Cybersecurity Week Hong Kong Sub-forum organised by the DPO on 17 September and spoke as a panellist at a roundtable discussion.
 
At the roundtable discussion session titled “Safeguarding Cross-border Data, Strengthening Cybersecurity”, the Privacy Commissioner highlighted the advantages of Hong Kong’s personal data protection regime in aligning with international standards while maintaining connectivity with the Chinese Mainland. She introduced the facilitation measures under the Standard Contract for Cross-boundary Flow of Personal Information Within the Guangdong-Hong Kong-Macao Greater Bay Area (Mainland, Hong Kong). In addition, the Privacy Commissioner introduced the “Artificial Intelligence: Model Personal Data Protection Framework” (Model Framework) published by the PCPD, which provides organisations with practical recommendations on AI governance to assist organisations to use AI safely and responsibly.
 
The Privacy Commissioner also attended the Macao Sub-forum organised by the Judiciary Police of Macao on 18 September as an officiating guest, and exchanged views with cybersecurity professionals in Macao on topics relating to cybersecurity and data security.
 
Separately, the Assistant Privacy Commissioner for Personal Data (Corporate Communications and Operations) Ms Joyce LAI joined the Hong Kong cybersecurity industry delegations to attend the 2026 China Cybersecurity Week main venue events in Jinan.

Promoting Privacy Protection in AI – Privacy Commissioner Speaks at the Directors’ Symposium 2026

Privacy Commissioner Ms Ada CHUNG Lai-ling attended the Directors’ Symposium 2026 organised by the Hong Kong Institute of Directors on 10 September and spoke as a panellist in a panel discussion.
 
At the panel discussion titled “Boardroom Accountability: Balancing AI Innovation with Governance”, the Privacy Commissioner highlighted the importance of sound AI governance and introduced the various guidance materials issued by the PCPD, including the “Model Framework” published in 2024, “Checklist on Guidelines for the Use of Generative AI by Employees” published in 2025 and the “Protecting Personal Data Privacy in the Use of Agentic AI” published in August. She also shared practical recommendations to assist boards in leading their organisations to establish AI governance frameworks, harness the benefits of AI while safeguarding personal data privacy.

Reaching Out to the Community – Privacy Commissioner Interviewed by Metro Radio’s “Finance Boulevard” to Share Tips on Protecting Children’s Privacy and Safeguarding Data Security

Privacy Commissioner Ms Ada CHUNG Lai-ling was interviewed by Metro Radio’s “Finance Boulevard” on 8 September, where she shared insights on how parents and schools can protect children’s personal data privacy, and how SMEs can enhance data security.

During the interview, the Privacy Commissioner noted that public awareness of children’s privacy protection has increased in recent years. For example, some parents would cover up their children’s faces when posting photos on social media platforms to reduce the risk of such images being manipulated through deepfake technology and misused for improper purposes such as cyberbullying and doxxing. She recommended parents to refer to the PCPD’s pamphlet entitled “Sharenting Dos and Don’ts” to learn more about the precautionary measures to be taken when sharing their children’s daily lives on social media platforms.

The Privacy Commissioner also pointed out that, as teaching and school administration become increasingly digitalised, schools must maintain robust personal data management and protection measures. In addition to clearly explaining to parents and students the types of personal data that will be collected and the purposes for which the data will be used through a Personal Information Collection Statement, schools should also adhere to the principle of data minimisation by collecting only necessary, but not excessive, personal data for teaching or administrative purposes. 

The Privacy Commissioner further highlighted during the interview that the PCPD and the Hong Kong Internet Registration Corporation Limited have launched the “Data Privacy and Web Security Scan Programme”, which aims to help schools, non-profit-making organisations and SMEs identify potential website security risks and personal data protection vulnerabilities through website security scanning services to further strengthen their overall cybersecurity and protection resilience.

Reaching Out to the IT Sector – Privacy Commissioner Attends ISACA China Hong Kong Chapter 2026 Annual Conference Cocktail

Privacy Commissioner Ms Ada CHUNG Lai-ling and the Assistant Privacy Commissioner for Personal Data (Corporate Communications and Operations) Ms Joyce LAI Chi-man attended the cocktail reception of ISACA China Hong Kong Chapter 2026 Annual Conference (Conference) on 4 September and mingled with members of the information technology (IT) profession.

Under the theme of “Critical Dependencies: AI, Data, and the Future of Global Security”, the Conference examined how organisations could ensure system security of interconnected AI and data ecosystems that presently underpin global commerce, government operations and daily lives.

Reaching Out to the Media Sector – Privacy Commissioner Attends HK01’s 10^th Anniversary Celebration Reception

Privacy Commissioner Ms Ada CHUNG Lai-ling and the Assistant Privacy Commissioner for Personal Data (Corporate Communications and Operations) Ms Joyce LAI Chi-man attended HK01’s 10^th Anniversary Celebration Reception on 3 September.

The Privacy Commissioner extended her heartfelt congratulations to HK01 and wished the organisation continuous prosperity, and to continue providing quality news content to the community, while telling a good China story and a good Hong Kong story.

Protecting Children Privacy – Assistant Privacy Commissioner Attends “I Have Something to Say” Children’s Forum 2026

The Assistant Privacy Commissioner for Personal Data (Corporate Communications and Operations) Ms Joyce LAI Chi-man attended the “I Have Something to Say” Children’s Forum 2026 (Forum) organised by the Hong Kong Committee on Children’s Rights on 12 September as a responding guest, where she exchanged views with children on the theme “Children’s right to privacy should be respected”.
 
The Forum brought together five groups of children aged between 10 and 17 to share issues that concern them. The children also engaged in interactive discussions with responding guests and the audience. The Forum aims to raise public awareness of the United Nations Convention on the Rights of the Child and to provide a platform for children to speak out on issues that concern them.

Promoting Privacy Protection in AI – PCPD Representative Speaks at “Roundtable: The Development of Regulation and Professional Guidance on Medical AI in Hong Kong”

Senior Legal Counsel of the PCPD Ms Joyce LIU attended the “Roundtable: The Development of Regulation and Professional Guidance on Medical AI in Hong Kong” co-organised by the Centre for Medical Ethics and Law of the University of Hong Kong, PHG Foundation of the University of Cambridge and the Hong Kong Academy of Medicine on 19 September, where she delivered a speech and participated as a panellist in a roundtable discussion.
 
In her speech titled “Navigating Data Privacy Risks in Medical AI”, Ms LIU discussed the key personal data privacy risks arising from the use of medical AI tools. She also highlighted the various guidance materials issued by the PCPD, including the “Guidance on the Ethical Development and Use of Artificial Intelligence” and “Model Framework”, and shared some practical steps that the healthcare profession can take to ensure the safe and responsible adoption of medical AI.

MEDIA STATEMENT

PCPD Welcomes Hong Kong’s First Five-Year Plan and the Policy Address

The PCPD warmly welcomes the Honourable Chief Executive’s announcement of Hong Kong’s First Five-Year Plan and the Chief Executive’s 2026 Policy Address (Policy Address), which set out the medium- to long-term strategy for Hong Kong’s development, as well as the corresponding policy measures and major projects. The PCPD fully supports the Government of the Hong Kong Special Administrative Region (HKSAR) in leading all sectors of society to fully align with the National 15^th Five-Year Plan, and will make concerted efforts with the HKSAR Government and all sectors of society to ensure that the vision of Hong Kong’s First Five-Year Plan is effectively implemented, with a view to jointly promoting Hong Kong’s high-quality development.

Hong Kong’s First Five-Year Plan and the Policy Address set out a range of measures to accelerate Hong Kong’s development into an international innovation and technology centre. The PCPD fully supports the Government’s commitment to advancing the AI+ Initiative on all fronts and improving AI and data governance, with a view to putting in place a regulatory framework that is conducive to the development of AI in Hong Kong, while upholding the principle of adopting a holistic approach to development and security. The PCPD will continue to promote the development‑governance strategy on AI and facilitate privacy protection in the use of AI, including conducting compliance checks and studies on the use of AI by organisations in Hong Kong; fostering innovation through novel regulatory approaches such as the Sandbox; issuing and updating practical guidance materials relating to AI; and continuing the promotion of existing guidance and best practices, such as “Protecting Personal Data Privacy in the Use of Agentic AI”. At the same time, the PCPD will step up its efforts to promote data security and cybersecurity, including assisting organisations in Hong Kong in enhancing their cybersecurity and data security capabilities through the Data Privacy and Web Security Scan Programme, thereby strengthening the protection of personal data privacy and preventing data breach incidents.

The PCPD also welcomes the Government’s promotion in the integrated development of education, technology and talent, with a view to building Hong Kong into an international hub for high-calibre talents. With the establishment of the Academy in June this year, the PCPD will strive to gather international data scientists and privacy protection professionals in Hong Kong to meet our needs in technological innovation, industry development and national strategy. Moreover, the Academy will support the “AI for All” Inclusive Programme to enhance the AI literacy of the public and promote responsible use of AI.

With regard to deepening international exchanges and co-operation, the PCPD, as the co-chair of the Ethics and Data Protection in AI Working Group and the International Enforcement Cooperation Working Group of the Global Privacy Assembly, will continue to serve as a “super connector” and leverage Hong Kong’s international advantages, enhancing the voice and influence of the Country and Hong Kong in areas such as global privacy protection and AI governance, while facilitating the internationalisation of  Chinese standards.

In addition, Privacy Commissioner Ms Ada CHUNG Lai-ling, in her capacity as a member of the Hong Kong Expert Group on Cross-boundary Data Collaboration, warmly welcomes the Government’s initiatives to promote data flow, usage and secure data sharing in the GBA, and to leverage data as a key factor to catalyse the synergised development of the GBA.

MAINLAND CORNER

Highlights of the “Opinions of the Supreme People’s Court on Adjudicating Disputes Involving Artificial Intelligence in Accordance with Law”
《最高人民法院關於依法審理涉人工智能糾紛案件的意見 》 的重點

On 7 September 2026, the Supreme People’s Court of China issued the “Opinions of the Supreme People’s Court on Adjudicating Disputes Involving Artificial Intelligence in Accordance with Law” (Opinions). The Opinions is the first judicial guidance document issued by China’s highest judicial authority specifically addressing AI. Based on relevant provisions of laws such as the Cybersecurity Law and the Personal Information Protection Law, the Opinions sets out guiding principles and rules for handling AI-related disputes, covering areas such as AI tort liability, intellectual property, AI product liability. Key provisions focus on the regulation of acts such as AI face-swapping and voice cloning, “AI resurrection” of deceased persons, doxxing and algorithmic price discrimination.

 

最高人民法院於2026年9月7日發布《最高人民法院關於依法審理涉人工智能糾紛案件的意見》¹（《意見》），是首部由國家最高審判機構發布、涉及人工智能（AI）的司法裁判規則文件。《意見》依據《網絡安全法》及《個人信息保護法》等法律的有關規定，對涉AI糾紛案件處理提出了理念和規則指引，涵蓋AI侵權責任、知識產權及AI產品責任等多個範疇。當中重點規管「AI換臉擬聲」、「AI復活逝者」、「起底」及「大數據殺熟」等行為：

 

AI換臉擬聲及AI復活逝者²

《意見》指出，下列利用AI換臉擬聲的行為均構成對人格權益的侵害：

• 未經同意，利用AI處理自然人的姓名、肖像等，生成可識別該自然人的虛擬數字形象並使用、公開；
• 未經同意，使用自然人的聲音作為訓練語料，模仿該其音色、語調和發音風格等生成能夠識別該自然人的合成人聲；
• 操控生成合成的能夠識別特定自然人的虛擬數字形象、聲音實施不當行為或者發表不實言論，降低該自然人或者他人社會評價。

此外，利用AI技術擅自製作、使用死者的虛擬數字形象致使死者的姓名、肖像、名譽等受到侵害，死者近親屬可依據《民法典》的規定³請求行為人承擔民事責任。

 

涉及AI的起底行為⁴

針對「網絡開盒」、「人肉搜索」等侵害自然人隱私權的行為，《意見》規定，若以刺探隱私為目的，利用AI對特定自然人的電話號碼、網絡賬號及社交媒體等公開信息進行追蹤、分析，獲取私密信息，或者將所獲取的私密信息洩露、公開，或者利用所獲取信息侵擾私人生活安寧的，應當認定構成對隱私權的侵害。

 

此外，利用AI對特定自然人的私密空間、私密活動等實施拍攝、窺視、竊聽等行為，應當認定構成對隱私權的侵害⁵。

以公開個人信息訓練AI模型⁶

《意見》規定，為訓練AI模型，在合理範圍內處理個人自行公開的或者其他已經合法公開的個人信息，且個人未明確拒絕，一般不認定為侵害個人信息權益的行為。若對個人權益有重大影響，應當依照法律規定取得個人同意。

 

在認定上述合理範圍時，應當綜合考量處理個人信息的目的與模型功能的必要性和適當性，所涉個人信息的類型、敏感程度及對個人權益的潛在影響，個人公開信息時的場景及可合理預期的使用範圍等因素。

 

生成式AI服務提供者的侵權責任⁷

《意見》提出，若生成式AI自動生成的內容侵害他人名譽權、隱私權等人格權益，生成式AI服務提供者在收到權利人通知後未及時採取停止生成侵權內容等必要措施，應當對造成的損害依法承擔侵權責任。

 

《意見》亦指出，若網絡用戶通過輸入侵權提示詞等方式惡意誘導生成式AI生成侵權內容並造成他人損害的，該網絡用戶應當依法承擔侵權責任。

 

大數據殺熟⁸

《意見》指出，針對同一商品或者服務，經營者利用算法在交易價格等交易條件上實行不合理的差別待遇，侵害他人合法權益造成損害的，人民法院應當依法認定其承擔相應的侵權責任。

 

在認定是否構成不合理的差別待遇時，應當根據差別待遇是否對消費者的知情權、自主選擇權、公平交易權等造成實質性限制或者損害，是否基於消費者的消費偏好、支付意願、支付能力、瀏覽記錄等信息形成針對其個人的交易條件，是否違背誠信原則及商業倫理等，綜合考量實行差別待遇的理由是否正當、充分、非歧視。

 

總結

《意見》就多項備受社會各界關注、與AI相關的法律問題提供裁判指引，對利用AI侵害私隱權等行為的責任追究作出了明確規範，在劃清法律「紅線」的同時支持AI技術創新發展 。AI開發者、服務提供者及使用者等各方宜細閱《意見》，確保符合現行法律的要求。

 

 

¹ 全文：https://www.court.gov.cn/zixun/xiangqing/511101.html

² 《意見》第四條。

³ 《民法典》第九百九十四條：「死者的姓名、肖像、名譽、榮譽、隱私、遺體等受到侵害的，其配偶、子女、父母有權依法請求行為人承擔民事責任；死者沒有配偶、子女且父母已經死亡的，其他近親屬有權依法請求行為人承擔民事責任。」

⁴《意見》第五條。

⁵ 法律另有規定或者該自然人明確同意的除外。

⁶ 《意見》第六條。

⁷ 《意見》第七條。

⁸ 《意見》第十條。

HONG KONG INTERNATIONAL DATA PRIVACY ACADEMY

The Academy was officially launched on 16 June 2026 by the Honourable Mr Paul LAM Ting-kwok, GBS, SC, JP, the Secretary for Justice of the Government of the Hong Kong SAR, China, and other officiating guests during the 30^th Anniversary Privacy Protection Summit of the PCPD.

 

The PCPD established the Academy to actively align with the Country’s 15^th Five-Year Plan in supporting Hong Kong’s development as an international high-calibre talent hub and the Government’s policy under the “One Country, Two Systems” principle to leverage the distinctive advantages of enjoying strong support of the Motherland and being closely connected to the world. It also aims to support the formulation and implementation of the Hong Kong’s First Five-Year Plan by the HKSAR Government under the leadership of the Chief Executive, thereby actively integrating into and serving the overall national development.

 

The PCPD 30^th Anniversary Privacy Protection Summit was the first signature event launched by the Academy. The Academy provides flagship training programmes on privacy/personal data protection matters for organisations, privacy protection practitioners and other stakeholders in Hong Kong, the Chinese Mainland and other parts of the world. The programmes, which include introductory seminars, professional workshops, topical seminars on emerging issues, dialogues with experts, in-house seminars and online training, are supported by various professional associations and industry groups. For details, please click here to visit the website of the Academy. 

Professional Workshop on Recent Court and Administrative Appeals Board Decisions

Legal professionals and compliance officers should keep abreast of the latest decisions and arguments of the court and the Administrative Appeals Board relating to personal data privacy. In this regard, the PCPD lawyer will give you a deep dive into those cases and the commonly deployed provisions of the PDPO, strengthening your understanding of the cases from a legal perspective and the knowledge in the interpretation and application of the PDPO.

 

Date: 14 October 2026 (Wednesday)

 

Time: 2:15pm – 5:15pm

  

Mode: Online

 

Language: Cantonese

 

Fee: $950/$760*
(*Members of the DPOC and supporting organisations may enjoy the discounted fee)

 

Accreditation: 3 CPD points (The Law Society of Hong Kong, Estate Agents Authority, Property Management Services Authority, Hong Kong Institute of Bankers)

 

Who should attend: Solicitors, barristers, in-house legal counsels, data protection officers and compliance officers, company secretaries and administration managers

Professional Workshop on Data Protection in Direct Marketing Activities

Organisations often use customers’ personal data to conduct direct marketing activities to promote products or services. These activities are governed by the PDPO. Organisations have the responsibility to ensure that their employees clearly understand and comply with the provisions on direct marketing under the PDPO, which also helps organisations maintain a positive reputation and demonstrate their corporate social responsibility. 

This workshop will explain in detail the requirements of the direct marketing provisions under the PDPO and provide participants with practical guidance on compliance and share conviction cases relating to direct marketing, aiming to help participants understand how to properly use customers’ personal data in direct marketing activities. 

 

Date: 28 October 2026 (Wednesday)

 

Time: 2:15pm – 5:15pm

  

Venue: Hong Kong International Data Privacy Academy, 12/F, Dah Sing Financial Centre, 248 Queen’s Road East, Wanchai, Hong Kong

 

Language: Cantonese

 

Fee: $750/$600*
(*Members of the DPOC and supporting organisations may enjoy the discounted fee)

 

Accreditation: 3 CPD points (The Law Society of Hong Kong, Insurance Authority, Estate Agents Authority, Property Management Services Authority, Hong Kong Institute of Bankers)

 

Who should attend: Data protection officers, compliance officers, company secretaries, administration managers, IT Managers, solicitors, database managers and marketing professionals

New Series of Professional Workshops on Data Protection in Nov and Dec 2026:

Online Free Seminars – Introduction to the PDPO Seminar

The PCPD organises free introductory seminars regularly to raise public awareness and their understanding of the PDPO. Details of the upcoming sessions are shown below: 

Seminar Outline:

• A general introduction to the PDPO;
• The six Data Protection Principles;
• Offences and compensation;
• Direct marketing; and
• Q&A session. 

Arrange an In-house Seminar for Your Organisation 

Teaching employees how to protect personal data privacy is increasingly recognised as an important part of employee training. If you wish to arrange an in-house seminar for your organisation to learn more about the PDPO and data privacy protection, you can make a request for an in-house seminar via our online form.

 

The seminar outline is as follows:

• A general introduction to the PDPO;
• The six Data Protection Principles (industry-related cases will be illustrated);
• Data security management;
• Handling of data breach incidents;
• Direct marketing;
• Offences and compensation; and
• Q&A session.

Duration: 1.5 hours

APPLICATION / RENEWAL OF DPOC MEMBERSHIP

Apply or renew your DPOC membership today and enjoy privileged access to course enrolments throughout the year!

 

Special Offer for Organisational Renewals:

Organisations can join the 2-for-1 scheme, which enables you to receive two memberships for the price of one annual fee (HK$450).

 

Join us now to keep up-to-date with the latest news and legal developments!

SUPPORTING EVENTS

PCPD Supports the BugHunting Campaign 2026

The PCPD participates in the “BugHunting Campaign 2026” (Campaign) as a Strategic Partner. Co-organised by the Cyber Security and Technology Crime Bureau of the Hong Kong Police Force and Cyberbay, the Campaign will adopt a bug bounty-based vulnerability detection model, integrating AI-assisted screening technologies with the expertise of cybersecurity professionals to provide free vulnerability detection services for participating organisations.

 

The Campaign is now open to SMEs and organisations for registration. Please click here for the details.

PCPD Supports the Education University of Hong Kong’s “Social Media Guardian Mascot Competition”

The “Social Media Guardian Mascot Design Competition” organised by the Education University of Hong Kong’s Social Media Analytics Research Team is now open for enrolment. The PCPD is pleased to be one of the supporting organisations of this event.

Please click here for the details.

SUGGESTION BOX

The PCPD values the opinions of all our DPOC members. We love to hear your ideas and suggestions on what privacy topics you would like to learn more about. Email your thoughts to us at dpoc@pcpd.org.hk and we shall include the most popular topics in our future e-newsletters.

Contact Us

Address: Unit 1303, 13/F, Dah Sing Financial Centre, 248 Queen’s Road East, Wanchai, Hong Kong

Tel: 2827 2827

 

If you do not wish to receive the PCPD e-Newsletter, please click here to unsubscribe.
 

Copyright

 

Disclaimer

The information and suggestions provided in this publication are for general reference only. They do not serve as an exhaustive guide to the application of the law. The Privacy Commissioner makes no express or implied warranties of accuracy or fitness for a particular purpose or use with respect to the information and suggestions set out in this publication. This publication also contains information or suggestions contributed by others, whose views or opinions are solely those of the contributors and do not necessarily reflect or represent those of the Privacy Commissioner. All information and suggestions provided in this publication will not affect the functions and powers conferred upon the Privacy Commissioner under the Personal Data (Privacy) Ordinance.

The PCPD shall not be liable for any damages (including but not limited to damages for loss of business or loss of profits) arising in contract, tort or otherwise from (i) the use of or inability to use this publication or its content, or (ii) from any action taken or decision made on the basis of the content of this publication.

If you click any hyperlink in this publication that brings you to sites operated by other organisations, the PCPD accepts no responsibility for the contents of those sites and shall not be liable for any loss or damage arising out of and/or incidental to the use of the contents.