Hong KongPersonal Data (Privacy) Ordinance, enforcement notices and compensation
Personal Data (Privacy) Ordinance (Cap. 486), ss. 50, 50A and 66
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Privacy Commissioner for Personal Data
- Obligation class
- Governance
As of .
What it requires
- Take the steps an enforcement notice specifies to remedy a contravention of the Ordinance by the date it specifies (sections 50 and 50A).
- Expect a claim for compensation, including for injury to feelings, from an individual who suffers damage from your contravention of a requirement of the Ordinance relating to their personal data (section 66).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Contravening an enforcement notice is an offence: a fine at level 5 and imprisonment for 2 years on a first conviction, and a fine at level 6 and imprisonment for 2 years on a second or later conviction, with a daily penalty of $1,000 or $2,000 if the offence continues after conviction (section 50A(1)). Intentionally repeating a contravention after complying with a notice carries a fine at level 5 and imprisonment for 2 years (section 50A(3)).
Penalty structure
Level 6 fine on a second or later conviction under section 50A(1), with imprisonment of up to 2 years and a daily penalty of $2,000 while the offence continues.
- Rule
- Fixed only
- As of
- Currency
- HKD
- Fixed cap
- 100,000
What this law does
After an investigation, the Commissioner may serve an enforcement notice on a data user that is contravening or has contravened a requirement under the Ordinance, directing it to remedy and prevent recurrence of the contravention.
A data user that contravenes an enforcement notice commits an offence carrying a fine at level 5 and imprisonment for 2 years on a first conviction, and a fine at level 6 and imprisonment for 2 years on a later one; it is a defence that the data user exercised all due diligence to comply. A data user that, having complied with an enforcement notice, intentionally repeats the contravention it specified commits an offence carrying a fine at level 5 and imprisonment for 2 years (section 50A(3)).
Section 66 entitles an individual who suffers damage by reason of a contravention by a data user of a requirement under the Ordinance to compensation from that data user, and the damage may include injury to feelings; it is a defence that the data user took such care as was reasonably required to avoid the contravention.
When LexLint raises it
When your app profile says your app processes personal data.