Portal:Office of the Privacy Commissioner for Personal Data, Hong Kong

“ The participating money lending companies are only charged when they use the TE Credit Reference System (i.e. a money lending company can gain unlimited access to a borrower's credit data for five days with a payment of $2, and this five-day cycle can be repeated with no limits set in terms of payment or access) . Thus, a money lending company can gain unlimited access to the credit data of a specific borrower as long as it declares that it has obtained authorisation from the borrower and pays the fees. ”

“ The public will reasonably expect that their personal credit data, whether positive or negative, would be adequately protected by credit reference agencies and would not be subject to unrestricted access by unauthorised or unrelated organisations. ”

“ The Vulnerability would enable an attacker to bypass security restrictions and directly obtain Secure Sockets Layer Virtual Private Network (SSL VPN) [5] account names and passwords to execute any programme in the target system. According to the Advisory, the Firewall manufacturer urged users to disable SSL VPN immediately until the operating systems were upgraded and all account passwords were reset. Meanwhile, users were recommended to enable multi-factor authentication. ”

“ Property management involves multidisciplinary professional services, including general property management services, environmental management of properties, repair and maintenance of properties, facility management, finance and asset management, human resources management, and legal services related to properties. ”

“ Organisations should formulate data backup policy, conduct regular backup for systems containing important data, and ensure that the recovery mechanism can effectively recover the loss data or inaccessible data due to malicious software/ ransomware. ”

“ Moreover, the Commissioner was of the view that the complainant gave his phone number to H-Privilege at the outset for communication about property management. The security guard's disclosure of the complainant's phone number to the resident concerned for private communication was a significant deviation from the purpose of use for which the complainant had consented to, and was also inconsistent with H-Privilege's original purpose of collection. Hence, the Commissioner found that H-Privilege had contravened the requirements of DPP3 (1) as regards the use of personal data. ”

“ Data should also be segregated according to its sensitivity and importance, and should be kept safely offline to avoid accidental loss. Monitor Service Providers Properly: When engaging information system service providers to maintain network infrastructure, organisations should first formulate service requirements according to industry best practice or operational guidelines (e.g. to install critical patches for organisations' operation systems and applications) . ”

“ In this case, Cheong Sun aimed to inform property owners by the notice that those 48 owners' overdue payments had put financial strains on Scenic Garden, and reminded those owners of their duty to pay the arrears as soon as possible. ”

“ This work is released under the Creative Commons Attribution 4.0 International license, which allows free use, distribution, and creation of derivatives, so long as the license is unchanged and clearly noted, and the original author is attributed. ”

“ Having considered all the evidence of this investigation, the Commissioner considered that HKIB:- failed to effectively manage data security risks, including failing to formulate patch management procedures, which resulted in the failure to patch the Vulnerability in a timely manner, thus allowing the hacker to successfully intrude into the system through the Vulnerability and encrypt the Servers ”

“ I, User's Name (HKID No./Other Document No. aaa) hereby authorize **** Loan Company Limited to inquire my related loan information for processing the loan application and repayment within the "TE Credit Reference System "hereafter. "Information" includes applied amount, installment periods, approval, rejection, payout, overdue payment, arrears, OCA, bad debt, and interest arrears. ”