Hong Kong data breaches bring notice gap into view

Hong Kong data breaches at an airline and two electronics retailers drew privacy-watchdog investigations on October 27. Customers of the airline and one retailer received suspected scam calls; the published accounts give no comparable call count for the third company. Reporting a breach remains voluntary under the city’s general privacy law, even though keeping personal data secure is not.

The Office of the Privacy Commissioner for Personal Data told RTHK that 815 Hong Kong Airlines passengers and 790 customers of Yoho Hong Kong were affected. That is 1,605 people across the two incidents with published counts; Broadway Photo Supply also reported an incident, but the reports cited here give no number for its customers. The office had received 23 complaints and 20 inquiries concerning the three incidents as of Monday, and launched investigations. Those are complaints and inquiries, not findings that any company broke the law.

Data breach reports give the watchdog a starting point

According to The Standard’s account of the privacy office’s disclosures, Hong Kong Airlines notified the office on October 2. The incident involved passenger names, phone numbers, flight dates, flight numbers and routes; callers allegedly offered compensation for canceled flights. Yoho reported on October 5 that customers received calls about supposedly damaged parcels and refunds, with names, phone numbers, delivery details, order numbers and purchased items among the information involved.

TVB News separately reported the three company notifications and the total of 43 complaints and inquiries. The broadcaster also described the calls as suspicious rather than treating every contact as an established fraud. The reports trace the incident details to the same privacy office. They do not establish how the information escaped or who obtained it.

Hong Kong Police had already warned about this kind of impersonation. In one Anti-Deception Coordination Centre alert, a buyer of Hong Kong Airlines tickets lost HK$1.36 million after a caller knew the flight number and departure time, promised compensation and directed the victim to a fraudulent website. A later police alert describes a separate HK$1.2 million loss in an airline-impersonation scam. Neither alert establishes that its victim was among the privacy office’s 815 airline passengers or that the three reported data incidents had a common cause. The police cases do show why a flight number can make a fake cancellation credible.

Hong Kong privacy law separates security from notice

The Personal Data (Privacy) Ordinance imposes data-security obligations on organizations that control personal information. Yet it does not currently impose a general mandatory duty to notify the regulator or affected individuals of a breach, according to DLA Piper’s Hong Kong data-protection guide. The privacy office’s nonbinding guidance encourages prompt notification, particularly where there is a real risk of harm. The three companies in this case did report incidents to the office; the point is about the legal framework, not an allegation that they failed to do so.

That distinction matters in both directions. A voluntary report does not absolve a company of its duty to take practicable security steps, and a privacy-office investigation does not prove those steps were lacking. The publicly reported call pretexts and affected-person counts do not establish whether a data-protection principle was breached.

DLA Piper also notes that a mandatory breach-notification mechanism was among reforms proposed in earlier years but was not enacted with the 2021 privacy amendments. The guide describes notification as best practice rather than a fixed statutory deadline under the general ordinance. That leaves the timing and detail of public warnings dependent on circumstances and organizational decisions, even when a targeted scam may be developing. The present reports do not establish when every affected customer learned of the incidents.

The customer consequence is immediate; liability is not settled

For a passenger or shopper, the practical concern is not an abstract count of compromised records. Names, phone numbers and transaction details can give a caller enough context to impersonate a merchant. The inquiry may clarify responsibility; customers meanwhile have to decide whether a call about a flight or parcel is genuine without treating a caller’s knowledge of their details as proof.

Broadway’s reported incident remains less quantified in the published accounts, and the precise cause of all three incidents remains unestablished here. A regulator finding or a fuller company account could clarify what happened. Until then, Hong Kong’s split regime is plain: the law requires care with personal data, while the notice that helps people react to its loss remains largely a matter of guidance.