HKU Law Colleagues Comment on the Cathay Pacific Data Leak (SCMP)

"‘Cathay Pacific should have alerted shareholders earlier about massive data leak’: calls for Hong Kong stocks regulator to probe matter"

South China Morning Post

4 November 2018

Airline only reported case to stock exchange as ‘inside information’ when approached by the Post Disclosure questioned under Securities and Futures Ordinance, especially since announcement was made after Cathay’s interim results in August.

     The five-month delay by Cathay Pacific Airways in notifying 9.4 million passengers about a data leak has sparked questions over whether the airline should have alerted its shareholders more promptly.

     ...

    Syren Johnstone, executive director of the LLM (compliance and regulation) programme at the University of Hong Kong’s law school, said in general, while a case of data hacking might not necessarily be inside information, it also depended on what had been accessed and the implications for a company’s security system as a whole. Johnstone said Cathay’s delay to inform the market was a concern that required further investigation by regulators to establish facts. He said he expected the Securities and Futures Commission (SFC) to take a closer look at why the hacking was announced after Cathay’s interim results in August [3], “when the data breach had been confirmed internally but not publicly”.

    “Directors should have been aware of the data breach long before their August board meeting to announce the interim results,” Johnstone added. 

    “If they were not aware, it suggests they may not have appropriate safeguards in respect of their disclosure obligations, which is itself a breach of the Securities and Futures Ordinance.” ... Click here to read the full text. 

"Hong Kong’s Cathay Pacific faces first collective legal action over massive data breach, with 200 customers poised to make claims"
South China Morning Post
30 October 2018

Cathay Pacific Airways is facing its first collective legal action in the wake of a massive data breach after about 200 customers expressed their intention to make claims over the leak, the Post has learned.

 ...

    Gary Meggitt, an expert in professional liability and the director of the Asian Institute of International Financial Law at the University of Hong Kong, warned that passengers ran the risk of having to pay legal costs for a claim in the English courts even if they have a “no win-no fee” deal with their lawyers. 

     “If the airline wins, its legal costs could still be on the passengers bringing the claim” he said. There could be “after-the-event” insurance for the passengers to cover these costs but they may still have to pay something. 

     Although successful claimants with “no-win-no fee” deal typically do not have to pay their lawyers’ fees in England, because the loser pays, passengers might still have to pay their own lawyers’ “success fee or bonus”, depending on the how the deal was structured, Meggitt said. Alternatively, it was possible in England for a third party company to fund the claim, but he wasn’t aware if this was the situation here. 

      And while Hong Kong runs a similar common law system to England, he said, passengers should be aware that the actual operation of evidence, lawyer-client confidentiality or the trial could still vary. ... Click here to read the full text.