About Office of the Privacy Commissioner for Personal Data

Office of the Privacy Commissioner for Personal Data

The Office of the Privacy Commissioner for Personal Data, known by its abbreviation PCPD, is Hong Kong's independent statutory regulator for personal data privacy. Established on 1 August 1996 under the Personal Data (Privacy) Ordinance (Cap. 486), it promotes, monitors and enforces compliance with the ordinance and its data protection principles across government and business. The ordinance, enacted on 3 August 1995 and in force from 20 December 1996, made Hong Kong one of the first jurisdictions in Asia with comprehensive data-protection law and an independent privacy regulator. Headquartered in Wan Chai, the office is headed by the Privacy Commissioner for Personal Data — Ada Chung Lai-ling has held the post since September 2020. Its official website is pcpd.org.hk.

The PCPD's functions include promoting awareness and understanding of the ordinance, approving and issuing codes of practice, investigating suspected contraventions, inspecting personal data systems, approving data-matching procedure applications, conducting privacy opinion surveys, and liaising with data-protection authorities outside Hong Kong. Its enforcement has evolved through two great amendments: the 2012-2013 reforms that tightened the rules on direct marketing and the sale of personal data, and the 2021 amendment that gave the Commissioner criminal investigation and prosecution powers against doxxing — now the office's most visible enforcement field, alongside data-breach handling and guidance on artificial intelligence governance.

Origins: law reform and the 1995 ordinance

Hong Kong's privacy law grew out of the Law Reform Commission's work on privacy in the late 1980s and early 1990s, which drew on the OECD privacy guidelines and the data-protection laws then emerging in Europe and the Commonwealth. The conclusion was that Hong Kong needed a comprehensive statute governing how organisations collect, hold, process and use personal data, supervised by an independent regulator rather than left to sector-by-sector rules. The Personal Data (Privacy) Ordinance was passed on 3 August 1995 and came into effect on 20 December 1996.

The ordinance was pioneering in its region: Hong Kong was the first Asian jurisdiction to enact comprehensive personal data privacy legislation and to establish an independent privacy regulator. The PCPD was established on 1 August 1996, ahead of the ordinance's commencement, so that guidance and administrative machinery would be ready when the law took force. Its first Privacy Commissioner was Stephen Lau Ka-man, who served from 1996 to 2001 and set the office's early direction: education and promotion first, enforcement through investigation of complaints and of suspected contraventions, and the building of a privacy culture in a city whose businesses had never before been answerable for their handling of personal information.

The ordinance and the data protection principles

The heart of the regime is the set of six data protection principles in Schedule 1 to the ordinance, with which every data user — any organisation that controls the collection, holding, processing or use of personal data — must comply. The principles govern the purpose and manner of collection, the accuracy and duration of retention, the use of data for purposes consistent with those for which it was collected, the security of data, openness about data policies and practices, and the rights of individuals to access and correct their own data. Hong Kong's regime is principles-based and technology-neutral, which has allowed a 1995 statute to remain applicable through the smartphone and platform eras.

The Commissioner's enforcement toolkit under the original design was administrative: investigation of complaints and own-initiative investigations under section 38 of the ordinance, inspections of personal data systems, and the issue of enforcement notices directing a data user to remedy a contravention — breach of an enforcement notice being itself an offence punishable by fine and imprisonment. The office also approves codes of practice for particular sectors and must approve certain data-matching procedures conducted by government. This design — an ombudsman-like regulator armed with notices rather than a fining authority — characterised the PCPD's first fifteen years and framed the debates that produced its later amendments.

Commissioners and institutional development

The office's leadership has passed through six commissioners. Stephen Lau Ka-man (1996-2001) founded the office. He was followed in the 2000s by Roderick B. Woo, under whom the office's profile rose amid growing public concern about direct marketing and data sales, and then by Allan Chiang Yam-wang, who led the PCPD through the implementation of the 2012 amendments. Stephen Wong Kai-yi served from 4 August 2015 to 3 September 2020, a tenure marked by large-scale data breaches in Hong Kong and the first waves of doxxing. Ada Chung Lai-ling, a former Registrar of Companies, took office on 4 September 2020 and has led the office through the 2021 anti-doxxing amendments and its work on artificial intelligence and cross-border data issues.

Institutionally, the PCPD has grown from a small start-up office into a regulator handling thousands of complaints and enquiries a year, a rising flow of data-breach notifications (140 received in 2021, up from 103 in 2020), and hundreds of compliance checks and investigations annually. Its publications — guidance notes, codes, investigation reports and educational materials — constitute much of Hong Kong's practical privacy literature, and its annual reports to the Legislative Council's Panel on Constitutional Affairs are the standard account of the state of data privacy in the territory.

The 2012 amendments: direct marketing and data sales

The ordinance's first great amendment followed public anger over the handling of customers' personal data by businesses — most notoriously the revelation in 2010 that Octopus, Hong Kong's ubiquitous stored-value card operator, had sold cardholders' personal data for marketing purposes over years, a scandal investigated by the PCPD that shook public confidence and demonstrated the weakness of the existing rules on data trading. The Personal Data (Privacy) (Amendment) Ordinance 2012, whose main provisions took effect on 1 April 2013, responded directly.

The amended regime imposed strict obligations on the use of personal data in direct marketing: data users must inform individuals of the kinds of data to be used and the classes of transferees, obtain consent, and honour opt-outs without charge; the sale of personal data attracted its own notification and consent requirements; and penalties were enhanced, with contraventions of the direct-marketing provisions becoming criminal offences carrying substantial fines and imprisonment. The PCPD's enforcement powers were strengthened in the same package, including a mechanism to provide legal assistance to aggrieved data subjects. The reforms converted direct marketing — previously governed mainly by the general principles — into a hard-edged compliance area, and the PCPD's guidance and prosecutions in the following years established the new rules in practice.

Data breaches and the digital caseload

Through the 2010s the office's work was increasingly shaped by data security failures. Hong Kong experienced major breach incidents involving airlines, telecommunications, credit reference and other data-rich sectors, and the PCPD's investigations, compliance checks and published reports became the public record of what went wrong and what remediation was required. Breach notifications to the office rose steadily — 140 in 2021 against 103 in 2020, involving hacking, system misconfiguration, unauthorised access by internal staff, loss of documents or portable devices, and inadvertent disclosure by fax, email or post.

Hong Kong's ordinance, unlike some newer regimes, does not impose a general mandatory breach-notification duty; notification to the PCPD and to affected individuals is encouraged as good practice, and the office publishes guidance on breach handling and response plans. The PCPD has also had to address privacy questions created by public policy itself — pandemic-era data collection, contact-tracing tools and health codes among them — issuing guidance for employers on collecting employees' personal data during COVID-19 and commenting on the privacy design of government systems, a role that places it in continuing dialogue with the administration it also regulates.

The 2021 amendments: criminalising doxxing

The defining recent change came from doxxing. From 2019, the disclosure of individuals' personal data online — names, addresses, family details, identification numbers — as a weapon in Hong Kong's social unrest became rampant: between June 2019 and June 2021 the PCPD received over 5,800 doxxing-related complaints. The pre-amendment law was ill-fitted to the problem: the old section 64 offence was narrow, and the PCPD had to refer criminal enforcement to the police and the Department of Justice. The Personal Data (Privacy) (Amendment) Ordinance 2021, in effect from 8 October 2021, rewrote the position.

The amendment created two tiers of doxxing offence: disclosing personal data without the data subject's consent, with intent or recklessness as to causing specified harm, is an offence punishable by a fine of up to HK$100,000 and two years' imprisonment; where the disclosure causes specified harm, a second-tier indictable offence carries a fine of up to HK$1,000,000 and five years' imprisonment. It empowered the Commissioner to conduct criminal investigations directly and to prosecute doxxing offences in the Magistrates' Courts, referring graver cases to the police or the Department of Justice, and to serve cessation notices requiring persons and online platforms — including non-Hong Kong service providers — to remove or restrict doxxing content. The PCPD made its first arrest under the new powers on 13 December 2021, in a case alleging disclosure arising from a financial dispute; doxxing enforcement has since been its most publicised criminal work.

Guidance, AI and international engagement

Alongside enforcement, the PCPD remains primarily an educator and guide. It issues guidance notes for sectors and technologies — property management, employee monitoring, cloud services, model contractual clauses for cross-border data transfers — and codes of practice under the ordinance. In 2021 it published guidance on the ethical development and use of artificial intelligence, among the earlier AI-governance documents issued by an Asian data-protection authority, and it has continued to develop guidance on AI and on the interface between Hong Kong's regime and the mainland's Personal Information Protection Law, a question of daily practical importance to Hong Kong businesses handling data across the boundary.

Internationally, the office works with data-protection authorities worldwide, participating in global privacy networks and liaising with counterparts on cross-border enforcement and standards. Domestically, it liaises with the Legislative Council through the Panel on Constitutional Affairs, which reviews its annual work reports, and it conducts publicity and education for sectors from schools to small businesses. Its complaint statistics — 2,200 complaints received in 2020-21 excluding doxxing cases, alongside hundreds of compliance checks initiated — illustrate a regulator whose routine administrative work continues beneath the headline criminal cases.

The office today

Today the Office of the Privacy Commissioner for Personal Data, under Commissioner Ada Chung, enforces the Personal Data (Privacy) Ordinance from its Wan Chai headquarters, investigating complaints and breaches, prosecuting doxxing offences, issuing cessation notices, and publishing guidance on questions from AI ethics to cross-border transfers. Its website, pcpd.org.hk, is the principal public source on Hong Kong data-privacy law. Almost thirty years after its creation, it remains one of Asia's longest-standing data-protection authorities, and Hong Kong's ordinance one of the region's longest-standing data-protection laws.

For a directory of Chinese public institutions, the PCPD is the privacy entry: founded in 1996 as Asia's pioneering privacy regulator, tested by the Octopus-era data-sale scandals into the direct-marketing reforms of 2012-2013, and transformed in 2021 into a criminal enforcement agency against doxxing while retaining its original principles-based supervisory role. Its six commissioners, from Stephen Lau to Ada Chung, have presided over the whole history of data privacy as a public right in Hong Kong.