Personal Data (Privacy) (Amendment) Ordinance 2012

Amendments to the Personal Data (Privacy) Ordinance include:

Disclosure of Personal Data Obtained Without Data User's Consent (effective 1 October 2012)

• It is an offence for a person to disclose any personal data of a data subject obtained from a data user without the latter’s consent and with an intent to (i) obtain gain for himself or another person, or (ii) cause loss to the data subject. It is also an offence if the unauthorized disclosure, irrespective of its intent, causes psychological harm to the data subject. The maximum penalty for these two new offences is a fine of $1,000,000 and imprisonment for 5 years.