( November 2, 2026, 02:45 GMT | Official Statement) -- MLex Summary: Hong Kong's Privacy Commissioner ruled that the Hospital Authority violated the city's data-privacy law after a vendor employee leaked personal information of 56,243 patients and hospital staff to the dark web. The investigation, triggered by an April 3 data-breach notification, found the authority failed to monitor vendor access, lacked role-based controls and conducted insufficient security audits of the surgical patient records system at United Christian Hospital. An enforcement notice has been issued directing stronger vendor monitoring, restricted data exports and regular security assessments, the regulator said in a statement on Friday.Statement attached....
Prepare for tomorrow’s regulatory change, today
MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.
Know what others in the room don’t, with features including:
- Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
- Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
- Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
- Curated case files bringing together news, analysis and source documents in a single timeline
Experience MLex today with a 14-day free trial.