The Immigration Department has signed a formal undertaking with the Privacy Commissioner for Personal Data to step up measures on personal data security.

Director of Immigration Simon Peh said the department has always been conscious of the importance of data protection and maintains a system which has a high standard of security.

"Nonetheless I agree that certain measures, if taken, can improve the existing security in relation to our management of personal data. We appreciate the positive suggestions made by the Privacy Commissioner in this matter. We trust that the steps which I have undertaken to adopt will further enhance the existing personal data protection system," Mr Peh said.

Pact details

According to the undertaking, the department will:

* prohibit the collection or retention of office documents as templates or sample case documents for future use by all staff unless the identifying particulars of individuals contained in them, if any, have been removed.

* require all staff to erase all identifying particulars of individuals from any such templates or sample case documents kept by them and confirm in writing that they do not currently hold any such templates or sample case documents that contain identifying particulars of individuals.

* categorise all office documents containing personal data in both paper and electronic forms, according to the sensitivity of the data, into classes ranging from absolute prohibition of photocopying or storing on portable electronic devices to data that can be taken or copied for use outside the office premises.

For more details click here.

Leakage incident

Regarding the department's recent leakage of sensitive personal data on the Internet, the department said it was due to the relevant staff's inadvertence in collecting and saving the soft copies of the document files as templates of sample case documents for self-study and future use in a personal computer at home, which had installed the "Foxy" file-sharing programme. 

Privacy Commissioner Roderick Woo said the incident was caused by the concerned staff's failure to handle personal data with care.

"Having considered the circumstances of the case and that the Immigration Department has undertaken to enhance its data security, I have decided not to take any further action but will monitor the proper compliance of the undertaking," Mr Woo said.