Category Archives: China, Hong Kong

Privacy Protection Principles, compare ISO29100, with Singapore and Hong Kong legislations

ISO 29100:2011 Privacy Framework is now a public available document and it offers a comprehensive framework. Hong Kong and Singapore Gov both enacted privacy regulations, I compare both regions’ privacy protection requirements with ISO29100. Below is a summary table. Will write more on each comparison later.

ISO 29001:2011 Eleven Privacy Principles  Singapore Nine Data Privacy Obligations  Hong Kong Six Data Protection Principles 
Clause 5.2 Consent and choice
The Consent Obligation (PDPA sections 13 to 17): An organisation must obtain the consent of the individual before collecting, using or disclosing his personal data for a purpose.
DPP3: unless the data subject has given prior consent, personal data shall be used for the purpose for which they were originally collected or a directly related purpose.
Clause 5.3 Purpose legitimacy and specification The Purpose Limitation Obligation (PDPA section 18): An organisation may collect, use or disclose personal data about an individual only for purposes that a reasonable person would consider appropriate in the circumstances and, if applicable, have been notified to the individual concerned. DPP1: personal data shall be collected for a purpose directly related to a function and activity of the data user; lawful and fair collection of adequate data; data subjects shall be informed of the purpose for which the data are collected and to be used.
Clause 5.4 Collection Limitation The Purpose Limitation Obligation (PDPA section 18): An organisation may collect, use or disclose personal data about an individual only for purposes that a reasonable person would consider appropriate in the circumstances and, if applicable, have been notified to the individual concerned. DPP1: personal data shall be collected for a purpose directly related to a function and activity of the data user; lawful and fair collection of adequate data; data subjects shall be informed of the purpose for which the data are collected and to be used.
Clause 5.5 Data minimization  No direct equivalent requirement  No direct equivalent requirement
Clause 5.6 Use, retention and disclosure limitation The Retention Limitation Obligation (PDPA section 25): An organisation must cease to retain documents containing personal data, or remove the means by which the personal data can be associated with particular individuals as soon as it is reasonable to assume that (i) the purpose for which the personal data was collected is no longer being served by retention of the personal data, and (ii) retention is no longer necessary for legal or business purposes. DPP2: all practicable steps shall be taken to ensure the accuracy of personal data; data shall be deleted upon fulfillment of the purpose for which the data are used.
Clause 5.6 Use, retention and disclosure limitation The Transfer Limitation Obligation (refer to PDPA section 26): An organisation must not transfer personal data to a country or territory outside Singapore except in accordance with the requirements prescribed under the PDPA.

“Prohibition against transfer of personal data to place outside Hong Kong except in specified circumstances” is in legislation but not yet in operation 

Clauses 5.7 Accuracy and quality The Accuracy Obligation (PDPA section 23): An organisation must make a reasonable effort to ensure that personal data collected by or on behalf of the organisation is accurate and complete if the personal data is likely to be used by the organisation to make a decision that affects the individual concerned or disclosed by the organisation to another organisation. DPP2: all practicable steps shall be taken to ensure the accuracy of personal data; data shall be deleted upon fulfillment of the purpose for which the data are used.
Clause 5.8 Opennes, transparency and notice The Notification Obligation (PDPA section 20): An organisation must notify the individual of the purpose(s) for which it intends to collect, use or disclose the individual’s personal data on or before such collection, use or disclosure of the personal data.  
Clause 5.8 Opennes, transparency and notice i)  The Openness Obligation (refer to PDPA sections 11 and 12): An organisation must implement the necessary policies and procedures in order to meet its obligations under the PDPA and shall make information about its policies and procedures publicly available. DPP5: formulates and provides policies and practices in relation to personal data.
Clause 5.9 Individual participation and access d)  The Access and Correction Obligation (PDPA sections 21 and 22): An organisation must, upon request, (i) provide an individual with his or her personal data in the possession or under the control of the organisation and information about the ways in which the personal data may have been used or disclosed during the past year; and (ii) correct an error or omission in an individual’s personal data that is in the possession or under the control of the organisation. DPP6: individuals have rights of access to and correction of their personal data. Data users should comply with data access or data correction request within the time limit, unless reasons for rejection prescribed in the Ordinance are applicable.
Clauses 5.10 Accountability (include data breach notification)  No direct equivalent requirement  No direct equivalent requirement
Clause 5.11 Information Security f)  The Protection Obligation (PDPA section 24): An organisation must protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks. DPP4: all practicable steps shall be taken to ensure that personal data are protected against unauthorized or accidental access, processing or erasure.
Clause 5.12 Privacy Compliance  No direct equivalent requirement  No direct equivalent requirement

4 key questions about your security programme

If you are the CISO of your organization and implementing a security programme, what questions shall you ask yourself to help realizing a successful programme rollout ? No, it is not about what software to use, what hardware to install, what process to put in place or even what vulnerabilities you are going to remediate or mitigate. In fact, they are:

  1. Are we doing the right things ?
  2. Are we doing them the right way ?
  3. Are we getting them done well ?
  4. Are we getting the benefits ?

Four simple questions about your security programme, all about the business results – but not technology, schedule, and resources. Four questions about the reality such that your company can make informed decision. In addition, each of the four questions can be further elaborated, for examples:

Are we doing the right things ?

  1. What technology, processes are proposed ?
  2. For what business outcome ?
  3. How do the deliverables within the programme contribute ?

Are we doing them the right way ?

  1. How will it be done ?
  2. What is being done to ensure that it will fit with other current or future capabilities ? (e.g. Business / Operational / Technical capabilities)

Are we getting them done well ?

  1. What is the plan for doing the work ?
  2. What resources and funds are needed ?

Are we getting the benefits ?

  1. How will the benefits be delivered ?
  2. What is the value of the security programme ?

You shall answer all the questions based on relevant, current accurate business-focussed information. By that time, I am sure, you will find that to have a successful security programme, it is no longer depending on the technology, process and policy only, but also an investment that has an enormous impact on creating and sustain business value.

Dissemination of Information Security Knowledge

The daily work as information security practitioner is rather a chaotic one. The challenges has nothing to do with the zero-day attack that may happen any second or project deadlines. After more than 12 years of experiences as auditor, security manager and security consultant, I found the security domain is growing exponentially as user and business are more aware of risks in their even more Internet connected lifestyle. A security manager job duty is expanding from purely IT departments controls to application controls and even to privacy compliance.

With such rapid development of risk landscape, daily work of a security practitioner is no different from studying three to four PhDs concurrently with hundreds of email arriving your mail box. Research in information security and risk management is difficult as it is still evolving and also closely tied to cultural and management style. Research skills are important but doing it alone without the directions and collaboration with other professionals is like the toil of Sisyphus.

“make the knowledge accessible and usable”

The most rewarding experiences in my career is the discussion and sharing with people in the industry. By joining activities and meetings organised by PISA, CSA, ISC2 and ISO SC27, I met with friends and mentors who are both intellectual and forwarding thinking. The idea of having a blog connecting information security professionals in Asia is coming from these experiences.

The satellite image at the top only shows the Asia regions are physically separated by ocean. It does not show there are also legislation, languages and ideology separations. These logical separations create some obstacles for close collaboration. Unlike security professionals in US and EU where they could meet and collaborate relative conveniently, Asia professionals will need to rely more on cyberspace for idea exchanges.

In short, this team blog has one goal as stated in the About page ” to inspire more information security professionals and practitioners to come forward and share their knowledge, understanding, and experience with the community.”