The Independent Police Complaints Council is seeking legal advice on whether action should be taken against the contractor involved in recent data leaks. A written apology will be offered to people affected.

Following the release of the report today on the leakage of personal data on the Internet, IPCC chairman Ronny Wong said the council will send a letter of apology to each of the people affected by the disclosure.

It will also publish a written apology in two Chinese and two English newspapers of wide circulation in Hong Kong.

It is in discussion with the Secretary of Security on an appropriate apology to be extended to affected police officers.

Mr Wong refuted any suggestion that any material fact involving the leaks had been concealed.

He said the council has provided the substance of its report to the Privacy Commissioner to facilitate his statutory investigation into the incident under the Personal Data (Privacy) Ordinance.

The council will continue to cooperate fully with the Privacy Commissioner in his investigation, will study its findings when available, and follow up as appropriate.

Mr Wong said, as the dispute is likely to be the subject of litigation or disciplinary proceedings between the interested parties, it would not be appropriate for the council to prejudge the dispute or seek to place blame.

However, he said the Government should investigate whether any of the civil servants involved have been involved in misconduct.

To prevent similar incidents, he said, no confidential data should be used in future council contracts with IT contractors as far as possible and, where test data are needed, dummy data should be used.

All future IPCC's contracts with IT contractors should stipulate that access to its data is on a "need to know" basis and should state expressly the confidential nature of the data which the contractor might encounter in the execution of such contracts, he said.

IPCC Secretariat staff members' awareness of data protection when using IT to process personal data should be enhanced, he added.

So far the IPCC has met 10 people affected by the leaks, most of whom are worried their data will be abused.

Mr Wong said so far none of them asked for compensation, adding the IPCC will consider any claim advanced and make recommendations to the Government in light of the merits of each case.

Government to study report

The Security Bureau said the Administration will study the report in detail and consider what follow-up actions are required and whether there had been any misconduct by the civil servants involved.

It appreciates and supports the council's actions in dealing with the incident and will continue to provide all necessary support in taking forward remedial measures outlined in the report, the bureau said.