Global Law Experts Logo

Find a Global Law Expert

Specialism
Country
Practice Area

Awards

Since 2010, the Global Law Experts annual awards have been celebrating excellence, innovation and performance across the legal communities from around the world.

Hong Kong Proposes Critical Infrastructure Cybersecurity Law

posted 3 weeks ago

Hong Kong does not have statutory requirements on critical infrastructure cybersecurity. However, critical infrastructure around the world is at risk of cyberattacks and the repercussions of such malevolent action can be extremely severe.

In recent years, legislation to protect the security of computer systems of critical infrastructure has been enacted in mainland China, Australia, the UK and the EU. Following in these footsteps, Hong Kong proposes to enact a new legislation tentatively titled the Protection of Critical Infrastructure (Computer System) Bill.

Regulation targets

The proposed legislation seeks to regulate the operators of critical infrastructure that are necessary for:

  1. The continuous delivery of essential services in Hong Kong across eight sectors (energy, information technology, banking and financial services, land transport, air transport, maritime, healthcare services, and communications and broadcasting);
  2. Maintaining important societal and economic activities in Hong Kong, like major sports and performance venues, and research and development parks.

The new law will regulate only computer systems that are related to the normal functioning of critical infrastructure, regardless of their physical location, but not the operators’ other systems.

The legislation will not apply to essential services operated by the government – like water supply, drainage and emergency relief – as the government already has comprehensive internal information technology security policies and guidelines. Consequently, government departments will continue to be regulated by the existing administrative framework.

Administration

A new commissioner’s office will be established under the Security Bureau, to implement the proposed legislation.

Designation

Whether a piece of infrastructure is designated as a critical infrastructure will depend on factors such as whether it provides essential services or maintains important societal and economic activities in Hong Kong, its reliance on information technology, and the severity of societal impact in the event of damage, loss of functionality or data leakage.

Operators

The commissioner’s office will expressly designate certain operators as critical infrastructure operators (CIOs). These operators will mostly be large organisations but the list of designated CIOs will not be made public to protect their critical infrastructure from potential cyberattacks.

Designated CIOs will be required to fulfil three types of obligations:

  1. Organisational. To maintain an address and office in Hong Kong; to report changes in the ownership and operation of the critical infrastructure; to set up a computer system security management unit with professional knowledge (may be outsourced) supervised by a dedicated supervisor of the CIO.
  2. Preventive. To inform the commissioner’s office of material changes to their critical computer systems like design, configuration, security and operation; to formulate and implement a computer system security management plan; to conduct a computer system security risk assessment at least once every year; to conduct a computer system security audit at least once every two years; to adopt measures to ensure that third-party service providers comply with relevant statutory obligations.
  3. Incident reporting and response. To participate in a computer system security drill at least once every two years; to formulate an emergency response plan; to notify the commissioner’s office about computer system security incidents (activities carried out without lawful authority on or through a computer system that jeopardise or adversely affect its computer system security) : (a) within two hours of becoming aware of a serious computer system security incident (one that has a major impact on the continuity of essential services, large-scale leakages of personal information), and (b) within 24 hours of becoming aware of other computer system security incidents.

Sector regulators

Certain essential service sectors are already comprehensively regulated by statutory sector regulators. These regulators can monitor the discharging of CIOs’ organisational and preventive obligations. At this stage, it is proposed that:

  1. The Hong Kong Monetary Authority will be the designated authority to regulate service providers in the banking and financial services sector; and
  2. The Communications Authority will be the authority responsible for regulating service providers in the communications and broadcasting sector.

Nevertheless, the commissioner’s office will fully grasp any incident and the response arrangements of all CIOs to co-ordinate, investigate and prevent incidents from spreading to other CIOs.

Code of practice

The commissioner’s office will issue a code of practice with requirements such as:

  • reporting of material changes to critical computer systems;
  • independent computer system security audits;
  • computer system security risk assessments;
  • computer system security management plans; and
  • incident response obligations.

Way forward

The government plans to present the proposed legislation to the Legislative Council by the end of 2024. After the bill is passed, the commissioner’s office will be established within a year. The legislation will come into effect within the following six months. READ FULL ARTICLE

By: Rossana Chu at YYC Legal LLP

Note: This material has been prepared for general informational purposes only and is not intended to be relied upon as professional advice. Please contact us for specific advice. 

Author

Find the right Legal Expert for your business

The premier guide to leading legal professionals throughout the world

Specialism
Country
Practice Area
LAWYERS RECOGNIZED
0
EVALUATIONS OF LAWYERS BY THEIR PEERS
0 m+
PRACTICE AREAS
0
COUNTRIES AROUND THE WORLD
0

Join

who are already getting the benefits
0

Sign up for the latest legal briefings and news within Global Law Experts’ community, as well as a whole host of features, editorial and conference updates direct to your email inbox.

Naturally you can unsubscribe at any time.

Newsletter Sign Up

About Us

Global Law Experts is dedicated to providing exceptional legal services to clients around the world. With a vast network of highly skilled and experienced lawyers, we are committed to delivering innovative and tailored solutions to meet the diverse needs of our clients in various jurisdictions.

Contact Us

Stay Informed

Join Mailing List

GLE