Hong KongPersonal Data (Privacy) Ordinance, offences for disclosing personal data without consent
Personal Data (Privacy) Ordinance (Cap. 486), s. 64
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Prohibition
As of .
What it requires
- Do not disclose a person's personal data without their relevant consent with an intent to cause them or a family member specified harm, or being reckless as to whether it would (section 64(3A)).
- Do not disclose personal data obtained from a data user without that data user's consent with an intent to obtain gain or to cause the data subject loss (section 64(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Disclosing personal data with intent to cause, or reckless as to, specified harm, where the disclosure causes that harm, is punishable on conviction on indictment by a fine of $1,000,000 and imprisonment for 5 years (section 64(3D)); without the resulting harm the penalty is a fine at level 6 and imprisonment for 2 years (section 64(3B)). Disclosing personal data obtained from a data user without its consent, with intent to obtain gain or to cause loss to the data subject, carries a fine of $1,000,000 and imprisonment for 5 years (section 64(3)).
Penalty structure
Fine on indictment under section 64(3D), with imprisonment of up to 5 years.
- Rule
- Fixed only
- As of
- Currency
- HKD
- Fixed cap
- 1,000,000
What this law does
Section 64(3A) makes it an offence to disclose personal data of a data subject without their relevant consent, with an intent to cause specified harm to the data subject or a family member or being reckless as to whether specified harm would be caused. Section 64(3C) makes the same disclosure a more serious offence where it causes specified harm, punishable on indictment by a fine of $1,000,000 and imprisonment for 5 years.
Section 64(1), which predates the 2021 amendment, separately makes it an offence to disclose personal data obtained from a data user without the data user's consent, with an intent to obtain gain or to cause loss to the data subject, punishable by a fine of $1,000,000 and imprisonment for 5 years.
A person charged has a defence where, among other grounds, the person reasonably believed the disclosure was necessary to prevent or detect crime, the disclosure was required or authorized by law, or the disclosure was made solely for a lawful news activity with reasonable grounds to believe its publication was in the public interest (section 64(4)).
Specified harm covers harassment, molestation, pestering, threat or intimidation, bodily or psychological harm, harm causing reasonable concern for safety or well-being, and damage to property.
When LexLint raises it
When your app profile says your app processes personal data.