PD(P)AC Paper No. 01/18

Transcription

1 PD(P)AC Paper No. 01/18 Minutes of the 52 nd Meeting of the Personal Data (Privacy) Advisory Committee held at 13/F, East Wing, Central Government Offices, 2 Tim Mei Avenue, Tamar, Hong Kong at 11:00 a.m. on 10 January 2018 Present Mr Stephen Kai-yi WONG, Privacy Commissioner (Chairman) Mr David WAN (Member) Ms Winnie YEUNG (Member) Mr Jimmy KWOK (Member) Ms Cordelia CHUNG (Member) Mr Stephen LOH (Member) Ms Connie LAM (Member) Mr Addy WONG (Member) Ms Rosanna LAW, Deputy Secretary for Constitutional and Mainland Affairs Bureau (Member) In attendance Mr Jacky LUM, Principal Assistant Secretary for Constitutional and Mainland Affairs Bureau Ms Britney CHOI, Assistant Secretary for Constitutional and Mainland Affairs Bureau Mr Daniel LEUNG, Chief Personal Data Officer (Head of Corporate Support and Enquiries Division), Mr Anthony CHAN, Senior Personal Data Officer (Second-in-charge of Corporate Support and Enquiries Division) (Secretary) 1

2 1 Newly Appointed Members 1.1 The Chairman welcomed all to the meeting, particularly newly appointed members, Ms Connie LAM and Mr Addy WONG. Noting that these two members came from different sectors and services with distinguished experience and expertise, the Chairman said it would be his privilege to be able to pick their brains and have their views and suggestions on the work of the Privacy Commissioner for Personal Data (PCPD) relating to the promotion, monitoring, and compliance with the Personal Data (Privacy) Ordinance (the Ordinance). 2 Minutes of the last (51 st ) meeting held on 20 June 2017 (Paper No. 14/17) 2.1 The Committee confirmed the minutes of the last meeting held on 20 June Matters arising from the minutes of the last (51 st ) meeting 3.1 This part of the discussion focused on matters arising from the minutes of the last meeting but not separately covered in other agenda items of this meeting. Consultancy services on Privacy Management Programme (PMP) 3.2 Referring to paragraph 2.3 of the previous minutes, the Chairman briefed Members that PCPD had designated a senior personal data officer to oversee the PMP. 3.3 A Member asked whether or not the PCPD would tailor-make industryspecific PMP. The Chairman replied that the PCPD would issue a general guidance note which is intended to be a primary source of information and generic enough to fit all industries. CPDO (CS&E) supplemented that the PCPD would promote PMP through DPOC members, and conduct professional workshops for public organisations. In this connection, the Civil Service Training and Development Institute under the Civil Service Bureau agreed to collaborate with the PCPD to run training sessions for civil servants in

3 Use of credit cards 3.4 Referring to paragraph 2.4 of the previous minutes, the Chairman briefed Members that the supplementary information on the privacy setting was uploaded on the PCPD s website in November Legal assistance scheme 3.5 Referring to paragraph 2.6 of the previous minutes, the Chairman briefed Members on the number of cases received and the actions taken to enhance the efficiency and effectiveness of the scheme. Education, promotion and publicity activities 3.6 Referring to paragraph 2.7 of the previous minutes, the Chairman briefed Members that the PCPD had touched base with the Hong Kong Federation of Youth Groups to organise seminars on personal data privacy for its members and the general public in Q The PCPD would continue to explore partnership with other sizeable youth organisations. [Post-meeting note: a seminar was jointly organised with the YMCA of Hong Kong in the afternoon on 10 January 2018]. 4 Report on section 39 cases (Paper No. 15/17 and Paper No. 21/17) 4.1 The Chairman briefed Members that the number of complaints dropped by 17% as compared with last year. He attributed the declining trend to the increasing public awareness of personal data privacy protection through the PCPD s implementation of a series of result-oriented promotion and education programmes. Moreover, the PCPD took the initiative to engage organisational data users of different industries with a view to assisting them in complying with the Ordinance through inspections, compliance checks, round-table discussions, seminars, workshops, talks and lectures. 5 Report on PCPD s major activities (Paper No. 16/17) 5.1 The Chairman briefed Members on the PCPD s major activities during the report period. Salient points are appended below: 3

4 5.2 The Chairman highlighted two recent convictions to Members. The first conviction case was related to direct marketing offence under section 35E(1) 1 of the Ordinance for using the personal data of a data subject in direct marketing without obtaining the data subject s consent. The convicted company pleaded guilty to the charge and was fined HK$3,000. This has been the first conviction for the offence of section 35E(1) since the amendment provisions of the Ordinance relating to direct marketing came into effect on 1 April The second conviction case was related to an offence under section 50(B)(1)(b) of the Ordinance for failing to comply with a summons issued by the Privacy Commissioner to attend before him to provide relevant information. The accused pleaded guilty to the charge and was fined HK$3,000. This has been the first conviction for such offence since the Ordinance came into effect. 5.3 The Chairman briefed Members that the 39 th ICDPPC with the theme of Connecting West with East in Protecting and Respecting Data Privacy was successfully held from 25 to 29 September 2017 at Kowloon Shangri-La Hotel, Hong Kong. A report on the details and achievements of the event was attached in PD(P)AC Paper No. 17/17. A Member praised the PCPD s achievements and the significance of the international conference. 5.4 The Chairman briefed Members that following the release of the English guide book titled Personal Data (Privacy) Law in Hong Kong A Practical Guide on Compliance 注意! 這是我的個人資料 in July 2016, the PCPD, jointly with the City University of Hong Kong Press, published a Chinese book titled Watch out! This is my personal data privacy in July 2017 for raising the awareness of the public and enhancing their knowledge of data privacy protection. The Chinese book won the Merit Award of Mono / Duotone Color Book Group under Book Printing Category of the 29 th Hong Kong Print Awards The English guide book would be revised in 2018 to reflect the changes of the privacy landscape and new cases. 5.5 The PCPD briefed Members that the PCPD is about to conclude a comparative study on the GDPR and the Ordinance with a view to identifying the differences. The PCPD would publish in the first quarter of 1 Section 35E(1) provides that a data user who has complied with section 35C by taking the specified actions (that is informing the data subject his rights and the requisite information) must not use the data subject s personal data in direct marketing without obtaining his consent. 4

5 2018 an Information Leaflet to assist organisations/businesses in knowing generally what they have to do on top of their usual data handling practices under the Ordinance. A Member requested the PCPD to carry out promotion and education activities to raise public awareness, particularly among SME. The Chairman thanked the Member for the suggestion and stated that the PCPD would conduct a series of promotion and education activities, which include speaking engagements with various associations, chambers of commerce, at seminars organised or participated by the PCPD, international conferences, and with law firms and overseas lawyers. Furthermore, a webpage on the GDPR, with regular updates, is available on the PCPD s website. [Post-meeting note: the GDPR Information Leaflet, which turned out to come in the form of a booklet, was published on 31 March We have written to inform the stakeholders of the availability of the booklet for downloading from the PCPD s website. Accompanying infographics for understanding at-a-glance has also been disseminated] 5.6 The Chairman briefed Members that a guidance note for SME titled Data Protection & Business Facilitation: Practical Advice for Small and Medium Enterprises was published in December As part of the endeavours to facilitate the SME s understanding of the requirements under the Ordinance, an enquiry hotline would be set up in March [Post-meeting note: the SME telephone hotline was launched on 26 March 2018] 5.7 The PCPD reviewed and revised the Guidance Note on Electioneering Activities issued in 2015 to remind candidates and stakeholders involved in election activities to comply with the requirements under the Ordinance. The Guidance Note titled Guidance on Election Activities for Candidates, Government Department, Public Opinion Research Organisations and Members of the Public covers different stages of election activities and provides stakeholders with practical guidance and advice. 6 Concerns, advice and practical tips issued by the PCPD (Paper No. 18/17) 6.1 The Chairman highlighted the concerns, advice and practical tips during the report period. 5

6 6.2 A Member raised her concern about recent online circulation of video clips and photos of private activities in hotel rooms, and requested the PCPD to remind the public to respect the privacy right of others. [Post-meeting note: the PCPD issued a media statement on 10 January 2018 to emphasise the use of recording devises and disclosure data should avoid intrusion into the privacy of individuals] 7 PCPD s Business Plan 2017 and The Chairman briefed Members on the implementation of PCPD s Business Plan With the concerted efforts across the office, all targets set out at the beginning of the year were achieved. The Chairman also updated Members on the PCPD s Business Plan Mr Daniel LEUNG briefed Members that the PCPD would have a new telephone system in place in Q It includes new functions such as queue position announcement and caller appointment service. 8 Any other business 8.1 There being no other business, the meeting was adjourned at 12:25 a.m. Office of the Privacy Commissioner for Personal Data, Hong Kong 18 April