Hong Kong Retailers Face Penalties for data Protection Failures
Table of Contents
By Anya Sharma | HONG KONG – 2025/08/21 10:44:09
Three retailers in Hong Kong, including the local branch of a Japanese multinational company that owns fashion brands lowrys Farm and “Niko and…”, have been found in violation of data protection rules following two cybersecurity breaches. These breaches compromised the private information of over 138,000 individuals.
Privacy Commissioner for Personal Data Ada Chung Lai-ling announced that investigations revealed Adastria’s failure to activate security measures provided by its software supplier. The investigations also exposed a lack of cybersecurity protection and audits at Kwong’s Art Jewelry and its subsidiary, My Jewelry.
The reports, released by Chung’s office on Thursday, detailed two data breaches initially reported by the businesses last November.
Retailers Neglected Data Security measures
The privacy watchdog stated that all three companies failed to implement all practicable steps to safeguard stored personal data against unauthorized or accidental access, processing, erasure, loss, or use.
“In the face of escalating cybersecurity threats, organisations should recognize that the personal data in their possession is a valuable asset…”
The data leak at Art Jewellery and My Jewelry impacted over 75,000 customers and approximately 4,400 current and former employees. Adastria’s breach affected around 59,205 local customers.
Understanding Data Protection and Cybersecurity
Frequently Asked Questions
- What is considered a data breach?
- A data breach is a security incident in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an individual unauthorized to do so.
- what are the potential consequences of a data breach for consumers?
- Consumers can experience identity theft, financial loss, damage to their credit score, and emotional distress.
- What steps can businesses take to prevent data breaches?
- Businesses should implement strong cybersecurity measures, conduct regular security audits, train employees on data protection best practices, and comply with relevant data protection regulations.
