23 Oct 2025HK01#7445
中學辦交流團雲端收集學生回鄉證疑泄個資 教育局要求校方交報告
A secondary school has been accused of mishandling students’ personal data, potentially compromising their privacy. Students at Lok Sin Tong Leung Kau Kui College in Sai Ying Pun recently posted on social media alleging that, while preparing for a mainland exchange trip, the school required them to upload their Home Return Permit information to Google Drive. However, appropriate access restrictions had not been set, allegedly allowing anyone with a school account to view and download the students’ personal data without authorisation, raising concerns that the privacy of the students concerned had been compromised.
The school responded in a notice to parents yesterday (22nd), saying that after learning of the incident, it immediately instructed the class teachers of the relevant classes to cancel the cloud-drive link and delete all uploaded copies of identity documents. It also said that a comprehensive investigation had confirmed that no copies of students’ identity documents had been found to have been leaked.
The Education Bureau said it had contacted the school immediately regarding the incident and followed up in accordance with established procedures, including requiring the school to submit a written report to the bureau explaining the incident. The Office of the Privacy Commissioner for Personal Data said it had launched an investigation in accordance with established procedures.
有中學被指不當處理學生個人資料，恐令學生私隱外泄。近日有西營盤樂善堂梁銶琚書院學生在社交平台發文，指控學校在預備學生到內地交流團時，要求學生將回鄉證資料上傳至Google Drive雲端硬碟，但未設定合適權限限制，導致任何持有學校帳戶者可在未經授權下，查閱及下載學生的個人資料，擔心相關學生的私隱因而外泄。
校方昨日（22日）向家長發通告回應事件，稱得知事件後，已即時指示相關班別的班主任取消雲端硬碟連結，並刪除所有已上載的證件副本檔案，又指經全面調查確認，未發現學生證件副本外泄的情況。
教育局指，已就事件即時聯絡學校，並按既定程序作出跟進，包括要求學校向教育局提交書面報告交代事件。私隱專員公署則指，已根據既定程序展開調查。
14 Nov 2023獨媒#8648
康文署新訂場系統疑外洩用戶全名 私隱專員稱有待調查「唔想咁快定性」
Several public organisations, including Cyberport and the Consumer Council, have successively been hacked, resulting in large-scale leaks of personal information. Investigations by the Office of the Privacy Commissioner for Personal Data and the Hong Kong Productivity Council found that 70% of surveyed businesses had suffered at least one cyberattack in the past year, with attacks including new methods such as QR codes and AI-generated phishing. The Office received notifications of 119 data-breach incidents last year, 30% of which involved public organisations. SmartPLAY, the Leisure and Cultural Services Department’s new booking system, was found to have exposed members of the public’s full names in Chinese. Privacy Commissioner Ada Chung Lai-ling said she learned of the incident last night and had not yet received any enquiries or complaints. She said an investigation by the department was awaited and that she “doesn’t want to label it so quickly.”
數碼港及消委會等多個公營機構相繼被黑客入侵，發生大規模個人資訊外洩。個人資料私隱專員公署及生產力促進局的調查發現，七成受訪企業過去一年最少遭受一次網絡攻擊，被攻擊手法不乏二維碼、AI生成釣魚等全新手法。去年公署收到119宗資料外洩事故通報，公營機構佔三成。至於康文署新訂場系統SmartPLAY被揭發洩露市民中文全名，私隱專員鍾麗玲指昨晚得悉事件，暫時未收到任何查詢或投訴，有待部門調查「唔想咁快幫佢定性」。
13 Sept 2022獨媒#2450
《選舉報告書》指選委私隱洩露事件 相信是職員「不小心」
The uncontested Chief Executive election concluded on May 8 this year. During the election, an incident involving the leak of election committee members’ information caused considerable dissatisfaction among several members. The report released today by the Electoral Affairs Commission gives a detailed account of the incident. A staff member attached the members’ personal telephone numbers, email addresses and signatures when sending a test email, and sent it to 64 election committee members and their assistants. The Commission has apologised to those affected. The report says the Registration and Electoral Office’s investigation found that the incident was believed to have been caused by the staff member’s “carelessness”, but that the office “must learn the lesson”.
沒有競爭的特首選舉今年5月8日完結，在選舉期間出現選委資料洩露的插曲，令多名選委大感不滿。選舉管理委員會今日發表的《報告書》，詳盡披露事件原委，有職員在發出測試電郵時，將選委的個人電話、電郵和簽名夾附在內，並發送給64名選委及其助理。選管會已向受影響人士致歉，《報告書》指選舉事務處調查後，相信是職員「不小心」所致，但處方「必須汲取教訓」。
13 Sept 2022獨媒#2454
職員寫錯私人電郵致選民私隱外洩 選舉事務處電腦禁上Gmail
The Electoral Affairs Office today released investigation reports into two data-breach incidents. One involved information about Election Committee members, but the investigation found it was believed to have been accidental. The other involved the Chinese and English names and addresses of more than 15,000 voters. An employee mistakenly sent the data to an unknown email address. Police subsequently located the recipient and found that the email had not been opened. There was insufficient evidence to prosecute anyone. The Electoral Affairs Office subsequently “enhanced data security” by introducing computer restrictions for some staff, including preventing access to Gmail, Yahoo Mail, iCloud Mail and similar services.
選舉事務處今日公布兩宗資料外洩事件調查報告，其中一宗涉及選委會委員資料，但調查後相信是「不小心」；另一宗涉及逾1.5萬名選民的中英文姓名及住址，員工錯誤將資料發送一個不明電郵，警方其後找到收件人，發現對方未曾開啟電郵，無足夠證據起訴任何人。選舉事務處此後「提升數據安全」，增加部分人員的電腦限制措施，即不能瀏覽 Gmail、Yahoo Mail、iCloud Mail 等功能。
15 Jul 2021立場新聞#1447
【起底刑事化】草案賦私隱專員刑事檢控、搜處所資訊解密權 下周三首讀
The Government earlier submitted a document to the Legislative Council proposing to criminalise doxxing. The bill will be gazetted on Friday (the 16th). It proposes a two-tier system, with the maximum penalty being a fine of $1 million and imprisonment for five years.
政府早前向立法會提交文件，建議將起底刑事化，草案將於周五（16 日）刊憲。草案建議分二級制，最高刑罰為罰款為 100 萬元及監禁 5 年。
15 Jul 2021立場新聞#1448
【起底刑事化】草案設「域外管轄權」 黃浩華：範圍過闊 憂科企誤墮法網
The Personal Data (Privacy) (Amendment) Bill 2021 was gazetted and scheduled for its first and second readings in the Legislative Council on July 21. The bill proposes criminalising the disclosure of a person’s personal data without their consent, commonly known as doxxing, with a maximum penalty of a HK$1 million fine and five years’ imprisonment. It also proposes granting the Privacy Commissioner various powers, including criminal investigations, prosecutions and extraterritorial jurisdiction. In emergencies, the Privacy Commissioner would be able to search premises and electronic devices and decrypt information even without a warrant.
《2021年個人資料（私隱）（修訂）條例草案》刊憲，於7月21日進行立法會首讀及二讀。草案建議將未經當事人同意而披露其個人資料（俗稱「起底」）的行為刑事化，最高刑罰為罰款100萬元及監禁5年。草案又建議賦予私隱專員多項權力，包括刑事調查、檢控及「域外管轄權」。在緊急情況下，私隱專員即使沒有手令，亦可搜查處所、電子器材及將資訊解密。
31 Mar 2021明報#1307
控罪書刪被告及案件主管資料 司法機構：平衡私隱 記協：失跟進線索
Without prior announcement, the Judiciary removed multiple items of information from charge sheets that had traditionally been available for media inspection, including the prosecution case officer’s details and the defendant’s date of birth and address. The case officer was instead identified by the handwritten words “police”. The Judiciary acknowledged the measure the following day in response to an inquiry by Ming Pao, saying that providing personal data involving a relatively high degree of privacy could undermine the proper administration of justice and would be disproportionate to the reasonable grounds for open justice.
司法機構在無公布下，在一向給予傳媒查閱的控罪書中刪去多項資料，包括控方案件主管、被告出生日期及地址等，而案件主管改以手寫「警察」二字代替。司法機構翌日在《明報》查詢下承認已實施此措拖，原因是提供涉及私隱度較高的個人資料或會損害妥善執行司法工作，與司法公開的合理理由不合比例。
29 Mar 2021立場機構#1298
【收緊公司查冊】將禁查董事、秘書完整身份識別號碼及住址 記協斥損新聞自由促撤回
The Financial Services and the Treasury Bureau announced that provisions under the Companies Ordinance that have been passed but are not yet in force will be implemented in May through a “make first, scrutinise later” procedure. Companies will no longer be required to make directors’ and secretaries’ full identification numbers and residential addresses available for public inspection. In future, only specified persons, including the data subjects, company members and public officers, may apply to inspect the information. The public and media will only be able to inspect partial identification numbers of directors and secretaries, and the correspondence addresses of directors.
財經事務及庫務局公布，將以「先訂立後審議」方式於5月落實《公司條例》中已通過但尚未生效的條文，容許公司不再提供董事、秘書的完整身份識別號碼和住址予公眾查閱。日後只有資料當事人、公司成員、公職人員等指明人士，可經申請查閱有關資料，但公眾及傳媒則只可查閱董事和秘書的部分身份識別號碼，以及董事的通訊地址。
2 Jan 2021立場新聞#1136
創科局長薛永恒：不排除強制安裝「安心出行」 市民應放下私隱考慮
Secretary for Innovation and Technology Alfred Sit Wing-hang said on a radio programme, when asked whether the public might be required to install LeaveHomeSafe in future, that he did not rule out any possibility. He said members of the public should temporarily set aside privacy concerns to fight the epidemic.
創新及科技局局長薛永恒於電台節目被問及日後會否強制市民安裝「安心出行」時，表示不排除任何可能，並稱市民為抗疫應暫時放下私隱考慮。
23 Dec 2020HKFP#1106
Hong Kong police ‘rebuke’ officer who showed reporter’s ID card on live stream following privacy commissioner probe
The Privacy Commissioner’s report says a police officer who showed a reporter’s ID card during a news livestream of a protest in December 2019 breached privacy laws.
Privacy Commissioner's report says police officer who showed a reporter's ID card on a news livestream during protest in Dec 2019 was in breach of privacy laws.
Translations are supplied by the source workbook. Consult the original reporting for context.
