Hong Kong privacy watchdog warns URA over leaked details of 199 tenants, owners

Hong Kong’s privacy watchdog has served a warning letter to the Urban Renewal Authority (URA) over its failure to prevent a leak of the personal details of 199 tenants and owners stored on a cloud platform.

The Office of the Privacy Commissioner for Personal Data issued an investigation report on Thursday and ruled that the URA contravened data laws by omitting key functions in security checks and failing to detect that the data was open to public access.

“The organisations that use cloud computing and cloud service providers have a shared responsibility to safeguard data security in a cloud environment, including the security of the personal data stored on the cloud, and comply with the relevant requirements of the Privacy Ordinance,” Privacy Commissioner Ada Chung Lai-ling said.

The leak involved the personal details of 199 tenants and owners who had signed up for briefing sessions in May last year on property acquisitions under the Nga Tsin Wai Road-Carpenter Road redevelopment scheme.

The e-form platform used by the URA was associated with the cloud platform ArcGIS Online, but the authority did not realise that personal data could be publicly accessed – without an account or password – until police received reports about the problem.

The personal details compromised included telephone numbers, names, details of ownership or correspondence addresses.