Hong Kong watchdog slams sports club for lax cyber security ahead of data breach

Hong Kong’s privacy watchdog has found that a major sports club had breached privacy rules ahead of a large-scale leak involving the personal information of around 72,000 members.

The Office of the Privacy Commissioner for Personal Data said on Tuesday that the South China Athletics Association (SCAA) had not taken all possible measures to protect the personal data of its members before the breach occurred in march

“(SCAA’s) awareness of the need to protect the personal data of its members was weak. The association, as a well-established sports association that has a significant amount of personal data, should monitor cyber security and data security,” Privacy Commissioner Ada Chung Lai-ling said at a media briefing .

“I am very disappointed that the association did not implement effective information system security measures to safeguard members’ personal data prior to the incident.”

He said the club’s failure to take the necessary steps to protect members’ personal information breached data protection principle 4(1) of the Personal Data (Privacy) Ordinance.

On March 18 this year, the SCAA notified the office that its servers were attacked by ransomware and had been maliciously encrypted.