On 14 November 2015, VTech Holdings Limited (VTech) was hacked, resulting in the personal data of about 6.4 million children and 4.9 million parents being compromised worldwide. Out of the more than 11 million people involved, 5 million of them had their data stolen. This is the largest cyber attack affecting children’s data worldwide. Investigations in Hong Kong, the United States and Britain are currently underway. Ironically, the VTech hack occurred shortly after both the current and former Hong Kong Privacy Commissioner (PC) raised concerns on the widespread collection and use of children’s personal data.
On 1 December 2015, following the VTech hack, the PC issued a guidance note on the Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children (Guidance on Collection of Children’s Data) and a leaflet entitled Children’s Online Privacy – Practical Tips for Parents and Teachers (with advice on how parents and educators should get involved in children’s online activities, etc). The Guidance on Collection of Children’s Data highlights the fact that children are a vulnerable group, and extra caution is required when handling their personal data.