Hong Kong is gearing up for its groundbreaking cybersecurity legislation

TLDR:

– Hong Kong is set to enact its first critical infrastructure cybersecurity law in response to cyber threats.

– The proposed legislation would require Critical Infrastructure Operators (CIOs) to strengthen the security of their critical computer systems (CCSs).

Article Summary:

On June 25, 2024, the Hong Kong Government proposed a new cybersecurity legislation aimed at protecting computer systems of critical infrastructures. The proposed Protection of Critical Infrastructure (Computer System) Bill would require CIOs to fulfill statutory obligations to enhance the security of their CCSs and prevent cyberattacks.

The proposed legislation includes the establishment of a Commissioner’s Office to oversee the implementation and enforcement of the law. The government is currently consulting stakeholders and plans to introduce the bill to the Legislative Council by the end of the year.

The legislation will focus on designated CIOs and CCSs, with specific statutory obligations and penalties for non-compliance. Designated authorities like HKMA and CA will monitor compliance in essential service sectors, and CIOs have the right to appeal decisions of the Commissioner’s Office.

However, further clarity is needed in areas like the scope of application, reporting obligations, and investigative powers of the Commissioner’s Office. The government aims to set up the Commissioner’s Office within a year of the bill’s passage and enforce the law within six months.