On 8 July 2011, the Government of the Hong Kong Special Administrative Region published the Personal Data (Privacy) Amendment Bill 2011 (the “Bill”) in the Government Gazette. This marks the beginning of the Bill’s passage through the Legislative Council (“LegCo”).
The Bill amends the Personal Data (Privacy) Ordinance (“PDPO”), which has remained unchanged since it came into force in 1996. It addresses key areas that have been the subject of recent high profile investigations, such as the Octopus case last summer, which brought the use of personal data in direct marketing into the spotlight.
The Bill introduces a number of new offences with heavy penalties at a level previously unseen under the PDPO – the highest being HK$1 million plus 5 years imprisonment for both sale and disclosure of personal data without consent. This represents a significant increase from the current penalties which peak at HK$10,000 and 2 years imprisonment.