Privacy protection: Privacy Commissioner for Personal Data Roderick Woo warns that the collection and use of leaked personal data warrants prosecution and civil action.

Privacy Commissioner for Personal Data Roderick Woo warns that the collection and use of leaked personal data from the Independent Police Complaints Council warrants prosecution and civil action.

Mr Woo said the data is collected for the council's internal use only, and anyone in possession of it should destroy it immediately. Anyone using the data is contravening the Personal Data (Privacy) Ordinance, and faces a $50,000 fine and two years jail. Data owners can also take civil action.

Mr Woo said the council will soon disclose its investigation results into the data leakage. Four complaints and three enquiries have been received so far.

A data registration system would be formed soon, requiring website operators to register the kind of personal data they collect, its purpose and use. He said with such a system in place, the commission could contact the webmaster immediately in case of complaints about data leakage.

Despite a manpower shortage, the commission will try its best to handle all complaints and take proactive action against serious and large scale data leakages, he said. He also called on legislative amendments to empower the commission to lay charges, instead of the present practice of relying on Police to take prosecution action.

Data conversion

Council chairman Ronny Wong said the leakage occurred during conversion of data by a contractor.

During 2003-04, the Complaints Against Police Office passed an accumulative set of personal data to the council on CDRom, while the contractor was responsible for converting the data for use in the council's computer system.

During the process, the contractor uploaded the data on to an Internet server that required passwords, but it had not realised access to the server and downloading of the data did not need any passwords.

Mr Wong said only seven cases involving the leaked data are on-going. He said over the past weekend, the council's hotline has received 106 calls. It will form two sub-committees, to be chaired by Mr Wong and vice-chairman Alan Leong, to handle cases of genuine concern.

The council has also written to Google and 10 other service providers to ask for their co-operation in erasing the data.

Provisional measures have been put in place, including upgrading the computer system's capability, limiting the right of access to the database, placing the computer inside a locked room, logging of access to the database and imposing security checks on outside workers.

He wants to rebuild public confidence in the council.