Skip to content

Something urgent? Call us now! (852) 3416 1711

Data leak highlights security flaws

By Claire Chow

Hong Kong, 29 December 2023: Organisations have been reminded by the Privacy Commissioner to implement robust data protection measures after popular online marketplace Carousell suffered a “serious” leak of users’ personal information in January last year. After investigating the incident, Hong Kong’s privacy watchdog has published a report which includes a list of recommendations designed to prevent such data security lapses.

Carousell is a Singapore-based retail platform for the buying and selling of new and second-hand goods. It operates in its home city plus Hong Kong, Malaysia, Indonesia, the Philippines and Taiwan, with tens of millions of users. In October 2022 it discovered that the personal data of 2.6 million users – including almost 325,000 in Hong Kong – was being sold on the dark web. It immediately informed the Privacy Commissioner and the affected customers.

The platform said the data breach was caused by a security vulnerability that was introduced during a system migration in January 2022. Hackers accessed and stole the information – including email addresses, phone numbers and birthdays – during the following May and June. The stolen information could allow criminals to directly contact victims, or steal their identity to scam others, or access other accounts belonging to them.

After completing her investigation, Privacy Commissioner Ada Chung listed five deficiencies causing the leak: failure to conduct a privacy impact assessment prior to the system migration; incomprehensive code review process; inadequate security assessment associated with the system migration; lack of a written policy in relation to the code review process; and lack of effective detection measures.

Considering Carousell’s extensive international operations and the vast number of active users it serves, Ms Chung said it was “reasonable to expect that the Carousell Group, including Carousell Limited in Hong Kong, would have invested sufficient resources in ensuring the robust security of its information systems”. However, the incident revealed “fundamental failures” to ensure personal data security. She observed that the leak “could have been avoided if some normal risk and security assessment procedures and tools had been implemented”.

The Privacy Commissioner concluded that Carousell had not taken all practicable steps in relation to the system migration to ensure that the personal data was protected from unauthorised or accidental access, processing, erasure, loss or use, thereby contravening Data Protection Principle 4(1) of the Personal Data (Privacy) Ordinance (Cap 486) (the “PDPO”).

She has served an Enforcement Notice on the platform, directing it to remedy and prevent recurrence of the contravention. Steps it must take include engaging an independent data security expert to review its web and mobile applications, conducting security assessments and improving data protection training for all staff. Carousell has two months to provide documentary proof that it has implemented the measures.

As part of her report, Ms Chung has made the following recommendations on strengthening security to organisations which may perform information system migration involving personal data:

  • Carry out privacy impact assessments, especially when significant changes are made to systems;
  • Develop a migration plan that prioritises data protection;
  • Conduct effective vulnerability assessments;
  • Provide relevant employee training;
  • Implement an effective mechanism for detecting abnormal activities; and
  • Formulate localised policies and procedures to ensure compliance with the PDPO.

In addition, given that the Carousell Group is based in Singapore, the Privacy Commissioner has shared her report with Singapore’s Personal Data Protection Commission in accordance with a Memorandum of Understanding between the two bodies.

The report is a timely reminder that data leaks and other cyber security breaches are increasing worldwide, leaving individuals and organisations exposed not only to immense inconvenience but also reputational damage, financial loss and potential legal consequences. Robust safety systems help maintain sound business relationships, increase public confidence and reduce the risk of litigation.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.

40+ years of legal experience is just a click away.

Friendly and approachable, we are ready to answer your questions and offer you sound advice.

Contact us now

BC&C-contact-us

News & Knowledge

Learn more about what we do and what we say. Subscribe to our newsletter to ensure you receive our updates.

  • This field is for validation purposes and should be left unchanged.

A flying visit and a grounded bird

Hong Kong, 16 April 2025: It is gratifying to know this monthly blog has a sizeable following – and thanks for the positive feedback, everyone – but your correspondent is left in the shade by the wildly popular Darren Jason Watkins Jnr. Who? Otherwise known as IShowSpeed, or simply Speed, he is social media royalty, […]

Read more

Crackdown on ‘space oil’ intensifies

By Arthur Chan Hong Kong, 10 April 2025: Following a surge in the popularity of “space oil”, several key ingredients used to make the narcotic have been classified as dangerous drugs by the Security Bureau. The move brings with it heavy penalties for unauthorised possession, consumption or trafficking of the substance. Space oil has rapidly […]

Read more

First cybersecurity bill becomes law

By Claire Chow Hong Kong, 7 April 2025: A new law designed to enhance the protection of computer systems deemed essential to the smooth running of Hong Kong has been passed by the Legislative Council on 19 March 2025. It is expected to come into effect on 1 January next year. The Protection of Critical […]

Read more

Pádraig Seif reflects on his HK journey

Hong Kong, 3 April 2025: BC&C’s Foreign Legal Consultant Pádraig Seif was delighted to share his experiences as a Hong Kong citizen, business leader and lawyer in a keynote address at a seminar organised by Our Hong Kong Foundation. Born and raised in Germany with Irish roots, Pádraig’s Asian odyssey took him first to Japan […]

Read more

Law & More: Episode 51 – Mohan Bharwaney SC

Hong Kong, 2 April 2025: In this episode, we are joined by Mohan Bharwaney SC, a retired justice of the High Court who has authored a significant number of landmark judgments in the field of personal injury and medical negligence. Mohan reflects on his upbringing in Hong Kong, early days as a barrister and some […]

Read more