The Monetary Authority is studying HSBC's report on the loss of a computer server containing customer data, and supervisory action may be taken if the bank has breached personal data protection guidelines, Secretary for Constitutional & Mainland Affairs Stephen Lam says.

The authority received HSBC's notification on May 2 concerning the loss of a computer server containing customer data on April 26. It ordered the bank to inform affected customers, boost personal data protection and submit an incident report.

Mr Lam told lawmakers today the authority has issued to banks clear guidelines on protection of customer data, covering incident management procedures and the notification mechanism. It will scrutinise HSBC's incident report from a supervisory perspective.

Disciplinary review

On recent incidents in which certain Police internal documents were found online, Mr Lam said the cases have been referred to the Commercial Crime Bureau's Technology Crime Division for investigation.

For cases which have not been found to involve any criminal element, Police have embarked on a disciplinary review and action will be taken against those who have failed to observe the rules.

Police have formed a working group to review measures and procedures regarding information security and data protection, and propose upgrades to reduce the risk of leaking personal or protected data.

Mr Lam said the Office of the Privacy Commissioner for Personal Data has been given an additional $1 million this financial year to enhance its promotional and educational work.

A training kit will be ready next year to boost the public and private sectors' knowledge on the proper handling of personal data. A series of seminars and case studies will be held for bureaux and departments to bolster their understanding of the Personal Data (Privacy) Ordinance.