Hong Kong Privacy Commissioner’s Office Publishes Investigation Findings on the Electrical and Mechanical Services Department Data Breach

Hong Kong’s Privacy Commissioner reported an enforcement action on a data breach at the Electrical and Mechanical Services Department (EMSD), where personal data from 14 COVID-19 RTD operations in 2022—covering over 17,000 individuals and including names, addresses, HKID numbers, contact details, demographics, vaccination status, and PCR test results—was inadvertently left publicly accessible on ArcGIS Online e-forms without login due to incorrect assumptions about automatic data deletion after contract expiry; upon notification in April 2024, EMSD had the data removed and filed a breach notice.