Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

Hong Kong Healthcare Clear all filters

1case from 1 jurisdiction

–Total of monetary amounts (0 cases with an amount)

–Largest single case

–Median per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by authority

Privacy Commissioner for Personal Data (PCPD), Hongkong – 0 % · 1 case

What for?

by area of law

All areas of law

Data protection – 0 % · 1 case

Who?

by company

Anonymised companies – 0 % · 1 case

When?

per year, by date of decision

Trend
Period	Cases	Total
2022	1	–
2023	0	–
2024	0	–
2025	0	–
2026	0	–

1 case

Newest first Highest amounts

14 Nov 2022 a Hong Kong listed healthcare groupHealthcare group shared client data across brands: enforcement notice Hong KongData subject rights and transparencyanonymised Order

In an investigation report published on 14 November 2022, the Privacy Commissioner for Personal Data (PCPD, Hong Kong's data protection authority) found that the listed healthcare group, after acquiring two brands, had moved their clients' data into a group-wide system and made it accessible to staff of other brands; in the two underlying complaint cases the individuals concerned had neither been informed nor given their consent. The system was used by 28 of the group's 39 brands and held data on around 1.08 million members; the PCPD found a breach of the purpose limitation rule in DPP 3(1). By enforcement notice, the group must stop cross-brand sharing without consent, adopt policies for client data from acquisitions and train its staff.

What organisations can take from it

In acquisitions, client data must not simply be merged into group systems – the original purpose of collection and consent must cover the sharing.

Relevance to training and awareness

Purpose limitation and data sharing within a group after acquisitions

Missing or inadequate training played a role in the decision.

Authority / court: Privacy Commissioner for Personal Data (PCPD), Hongkong
Area of law: Data protection · Data subject rights and transparency
Legal basis: Personal Data (Privacy) Ordinance (Cap. 486), Schedule 1, Data Protection Principle 3(1); Enforcement Notice nach s. 50(1)
Action: Order
Status of proceedings: unknown
Sector: Healthcare
Published: 14 Nov 2022

Sources

Privacy Commissioner for Personal Data (PCPD), Hongkong, Veröffentlichung der Behörde (Entscheidung 2022) Decision of an authority

Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 Nov 2024 · Direct link

Report an error

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source (company names until they are anonymised).

Company names are anonymised two years after the decision in a case, in line with the practice of many supervisory authorities. The official sources remain linked.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Ready for training that actually lands?