Privacy Commissioner Warns Property Manager Over Data Breach at Hung Fuk Estate
On.cc · 2 SOURCESabout 2 hours ago5 MIN
Summary
The Privacy Commissioner for Personal Data has issued a warning letter to Ho On Management Limited (合安管理有限公司) following a data breach at Hung Fuk Estate (宏福苑) that exposed the personal information of 204 residents. The incident occurred in June when the property management company sent identity verification letters to owners who had signed a petition demanding an extraordinary general meeting. The letters contained other owners' personal data including names, addresses, Hong Kong identity card details, phone numbers, and signatures. The privacy regulator received seven complaints regarding the breach and has now completed its investigation, requiring Ho On to take effective corrective measures to prevent recurrence .
Key Points
- Ho On Management Limited sent identity verification letters in June to over 200 Hung Fuk Estate owners who signed a petition for an owners' meeting
- The letters inadvertently included other owners' personal data: names, estate addresses, HKID letters and first four digits, phone numbers, and signatures
- The Privacy Commissioner for Personal Data received seven complaints and confirmed 204 residents were affected by the data breach
- After investigation, the commission issued a warning letter to Ho On and recommended covering irrelevant personal data before sending documents
- Ho On acknowledged the leak when contacting the complaining owner by phone and subsequently issued a public apology statement
Why It Matters
The case underscores the importance of strict protocols when handling personal data in Hong Kong's densely populated residential estates, where management companies routinely deal with sensitive owner information. With the privacy regulator now requiring documented procedures, checklists, and regular staff training on data protection, this breach may prompt other property management firms to review their data handling practices to avoid similar violations and potential enforcement action .
The case underscores the importance of strict protocols when handling personal data in Hong Kong's densely populated residential estates, where management companies routinely deal with sensitive owner information. With the privacy regulator now requiring documented procedures, checklists, and regular staff training on data protection, this breach may prompt other property management firms to review their data handling practices to avoid similar violations and potential enforcement action .