(1) A person commits an offence if the person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent, with an intent—
(a) to obtain gain in money or other property, whether for the benefit of the person or another person; or
(b) to cause loss in money or other property to the data subject.
(2) A person commits an offence if—
(a) the person discloses any personal data 電話,FACEBOOK,真實姓名,相已經係 of a data subject which was obtained from a data user without the data user’s consent; and
(b) the disclosure causes psychological harm to the data subject.
(3) A person who commits an offence under subsection (1) or (2) is liable on conviction to a fine of $1000000 and to imprisonment for 5 years.
(4) In any proceedings for an offence under subsection (1) or (2), it is a defence for the person charged to prove that— (a) the person reasonably believed that the disclosure was necessary for the purpose of preventing or detecting crime; 除非樓主既目的係呢個, 可惜唔係 (b) the disclosure was required or authorized by or under any enactment, by any rule of law or by an order of a court; 更加唔係呢個
(c) the person reasonably believed that the data user had consented to the disclosure; or
(d) the person—
(i) disclosed the personal data for the purpose of a news activity as defined by section 61(3) or a directly related activity; and
(ii) had reasonable grounds to believe that the publishing or broadcasting of the personal data was in the public interest. Not related to any public interest.
Non-compliance with Data Protection Principles does not constitute a criminal offence directly. The Commissioner may serve an Enforcement Notice to direct the data user to remedy the contravention and/ or instigate the prosecution action.
Contravention of an enforcement notice is an offence which could result in a maximum fine of HK$50,000 and imprisonment for 2 years.
An individual who suffers damage, including injured feelings, by reason of a contravention of the Ordinance in relation to his or her personal data may seek compensation from the data user concerned.
The Ordinance also criminalises misuse or inappropriate use of personal data in direct marketing activities (Part VI); non-compliance with Data Access Request (section 19); unauthorised disclosure of personal data obtained without data user's consent (section 64) etc.
重點不在於罰幾多錢,而係點先構成犯法行為,何解唔QUOTE 埋上面D 要點:ro07: