What to do on Information Security?

There are existing laws and guidelines that govern the services and businesses conducted on the Internet. Both users and service providers of Electronic Services(e-Services) should observe and take notice of.

• Users
• Service Providers

Users

Understanding one's own rights is the first step to protect oneself in e-Service activities:

• Consumer Protection Principles in e-Commerce
  • A checklist of how to select safe website by the Consumer Council
• Privacy
  • Information on privacy law and individuals' rights from the Office of the Privacy Commissioner for Personal Data
• Telecommunications Consumer Interest
  • The Office of the Communications Authority provides information on telecommunication consumer rights, such as spam email
• Internet Banking - Keeping your money safe leaflet (in PDF format)
  • A leaflet about some practical tips and security precautions on Internet banking by the Hong Kong Association of Banks.
• Other available public services

Service Providers

Service providers must observe and follow ordinances and guidelines relevant to their own industry sector. Here are some of the major ones.

• General
• Banking
• Financial Services
• Insurance
• Telecommunications

• General :
  • Electronic Transactions Ordinance
    • Concerning the legal status of electronic records and digital signatures used in electronic transactions as that of their paper-based counterparts.
  • Major Principles in OECD Guidelines for Consumer Protection in the Context of Electronic Commerce
    • Containing principles and good practices on e-commerce
  • A Guide to Personal Data Privacy and Consumer Protection on the Internet (in PDF format)
    • Jointly published by the Hong Kong Productivity Council, Consumer Council and the Office of the Privacy Commissioner for Personal Data
  • A Practical Guide for IT Managers and Professionals on the Personal Data (Privacy) Ordinance (English only)
    • This Guide was compiled by Hong Kong Computer Society (HKCS) with the support of the Office of the Privacy Commissioner for Personal Data (PCPD). It aims to help enterprises, especially IT Managers and Professionals, to protect personal data privacy.
  • Preparing On-line Personal Information Collection Statements and Privacy Policy Statements
    • This guide provides data users with practical guidance on how to prepare on-line Personal Information Collection (PIC) Statements and Privacy Policy Statements (PPS)

• Banking :
  The Hong Kong Monetary Authority provides clear guidelines on e-banking :
  • Guidelines & Circulars
    • Providing guidelines and circulars regarding electronic banking, including :
      • No. 15.1 Electronic Banking (Jul 1997)
      • No. 15.1.1 Security of Banking Transactions over the Internet (Nov 1997)
      • No. 15.2 Basle Committee on Banking Supervision's Paper on 'Risk Management for Electronic Banking and Electronic Money Activities' (Apr 1998)
      • No. 15.3 Public Key Infrastructure and Legal Environment for Development of Internet Banking (Oct 1998)
      • Chapter 9 of Guide to Authorisation (September 2002) (in PDF format)
      • Guidance Note on Management of Security Risks in Electronic Banking Services (6 July 2000)
      • Guidance Note on Independent Assessment of Security Aspects of Transactional E-banking Services (26 September 2000)
  • Code of Banking Practice (in PDF format)

• Financial Services :
  • The Securities & Futures Commission offers guidelines on using the Internet for financial services, such as :
    • Guidance Note on Internet Regulations
    • Circular on Provision of Financial Information on the Internet - Licensing Requirement
    • Guidance Note on the Application of the Electronic Transactions Ordinance to Contract Notes
    • General Circular to All Registered and Licensed Firms on Internet Trading and Advising
  • Guidance Note on Internet Regulations Guidelines for Registered Persons Using the Internet to Collect Applications for Securities in an Initial Public Offering

• Insurance :
  • Guidance Note on the Use of Internet for Insurance Activities in Hong Kong
    • Concerning various issues regarding the use of the Internet for insurance activities such as system security, data integrity, privacy of client information and online sales of insurance products.

• Telecommunications :
  • Code of Practice on Protection of Customer Information for Fixed and Mobile Service Operators (in PDF format)
    • To ensure data relating to customers are properly protected from misuse. This is a joint effort made by the Consumer Council, Independent Commission Against Corruption, Office of the Privacy Commissioner for Personal Data and Office of the Communications Authority.

(To view and print the above documents in PDF format, you need to use an Adobe Acrobat Reader. Please click here to download if necessary. )