Privacy Commissioner for Personal Data (PCPD) is the independent statutory regulator with full investigation + inspection + enforcement powers. Investigation may be triggered by complaint or own-motion. Inspection power to inspect any personal data system (Section 36). Compliance Check + Compliance Audit. Enforcement Notice power (Section 50) requiring data user to remedy contravention + steps + timeframe; non-compliance is criminal offence (HKD 50,000 + 2 years first offence; HKD 100,000 + 2 years + HKD 1,000 per day continuing offence on repeat). Specific criminal penalties: DPP3 use without prescribed consent for direct marketing Section 35E (HKD 500,000 + 3 years); transfer for gain Section 35J (HKD 1,000,000 + 5 years); ignoring opt-out Section 35L (HKD 500,000); doxxing basic Section 64(3A) (HKD 100,000 + 2 years); doxxing aggravated Section 64(3C) (HKD 1,000,000 + 5 years); cessation notice non-compliance Section 66J (HKD 50,000 + 2 years). PCPD may apply to court for injunction. Appeal route: Administrative Appeals Board (AAB) Ordinance Cap 442 + then Court of First Instance + Court of Appeal + Court of Final Appeal. PCPD publishes Investigation Reports + Inspection Reports + Compliance Audits + Court Judgment summaries + AAB decisions. PCPD Anti-Doxxing Division operates 24/7 hotline + cooperation with HK Police + international platforms. 2024-2025 pending reforms include administrative fines power (currently only criminal + enforcement notices). HK PDPO PCPD enforcement + investigations + criminal penalties + AAB appeal applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.