The privacy commissioner yesterday criticized the Independent Police
Complaints Council (IPCC) for failing to protect personal data of complainants
while the council complained they had not been given the opportunity to present
its case.
The incident took place in March when the personal information of about
20,000 persons was found on a certain website, and it was subsequently revealed
they were records of people who had lodged complaints with the IPCC.
Those information was put on the web by a contractor company who was testing
a new computer system for IPCC.
Office of the Privacy Commissioner for Personal Data (OPCPD) investigated the
matter and yesterday the commissioner Roderick Woo Bun announced completion of
the report.
Woo said that IPCC had breached the Personal Data (Privacy) Ordinance and his
office had formally demanded IPCC to make improvements.
So far the OPCPD has received 55 complaints concerning the information
leakage, he said.
He pointed out that IPCC had failed to employ sufficient measures to protect
those information, and there was a lack of discussion among the IPCC staffer
handling the information, his supervisor and the contractor as to whether or not
to use fake information for testing. Moreover, there were no clear guidelines in
the security notice on handling the classified information issued by IPCC to its
employees.
Woo said the IPCC's submission admitted that the incident was the fault of
the information user. He cited the submission as saying that since IPCC was not
user of the information and the employee concerned had resigned, it could not
take part in the hearings.
Woo said his office did not accept the IPCC stance since it considered IPCC a
user of the information concerned.
Countering the OPCPD report, IPCC Chairman Ronny Wong, however, said in a
press conference later that the council was not given the opportunity to
explain. He accused the OPCPD of quoting out of context when it said in the
report that the IPCC totally accepted that the incident was the information
user's fault.
He said the report also failed to mention the government's responsibility,
and that it was not fair to ask them to shoulder the blame for the IPCC
Secretariat. The OPCPD has confused the duties of the IPCC and its secretariat,
he stressed.
In a statement, a government spokesman said that the Administration respected
the course of action taken by the Privacy Commissioner in accordance with the
Personal Data (Privacy) Ordinance.
