The new law will cover facilities delivering “essential services” in banking, financial and healthcare services, information technology as well as communications and broadcasting.
It will also apply to important equipment for the energy, land transport, air transport and maritime sectors.
Operators of important socioeconomic facilities, such as major sports and performance venues and science parks, are also subject to the new legislation, which is due to come into effect at the start of next year.
A new commissioner’s office under the Security Bureau will be set up to monitor operators and follow up on non-compliance.
The operators need to set up units protecting cybersecurity, regularly conduct drills and risk assessments, and report incidents within a designated time frame.
Those who fail to fulfil their responsibilities are subject to a fine of up to HK$5 million if convicted after trial, and a daily penalty of up to HK$100,000 if the lapses continue.
Security chief Chris Tang sought to reassure the public that the law won’t affect people’s personal information or confidential business information.
He said it is there to protect infrastructure that are essential for people to live their normal, everyday life.
“Regulated operators are those that are necessary for the continuous delivery of essential services or maintaining important societal and economic activities in Hong Kong,” Tang told lawmakers.
“They are mostly large organisations and small and medium enterprises, and the general public will not be regulated or affected.”
Commerce-sector lawmaker Martin Liao said the bill should be regarded as an indispensable part of local laws.
“Cybersecurity is a key part of national security. For our national security, this bill is crucial,” he said.
“Keeping the computer systems of critical infrastructure safe will strengthen Hong Kong’s resilience and safety, and that will enhance our international image.”
The chairwoman of the bill’s committee, Election Committee sector councillor Carman Kan, said the frequent number of cybersecurity issues in recent years show the law’s necessity.
