Hong Kong plans to revive privacy law mandating that firms report data breaches

Hong Kong’s privacy watchdog plans to consult lawmakers this year about introducing mandatory data breach reporting and related penalties, the body’s chief has said.Privacy Commissioner for Personal Data Ada Chung Lai-ling on Saturday revealed details about the proposed legislative amendments to the city’s privacy ordinance, after authorities stalled the measures in 2024 due to opposition from the business community.“We really hope that we have some specific recommendations this year, so we can consult the Legislative Council,” Chung said in a televised interview, adding the measures could be carried out in phases.The government in 2024 put on hold a legislative reform to empower Hong Kong authorities to penalise companies over data breaches due to concerns that it might put a dampener on the local business environment.Erick Tsang Kwok-wai, the former secretary for constitutional and mainland affairs, said authorities could consider a “piecemeal approach” by first introducing minor improvements to minimise the impact on small businesses.Chung, speaking on Saturday, said the Office of the Privacy Commissioner for Personal Data was considering measures such as the mandatory reporting of data breaches and the introduction of administrative fines for such incidents.She noted that one direction that authorities were considering was whether some measures could be put in place first, while fines could come at a later stage.