An investigation by Hong Kong's Office of the Privacy Commissioner for Personal Data found EC Healthcare failed to obtain consent from clients before transferring their personal data to two brands within its group. "Such practices were disappointing both from the perspective of compliance with the legal requirements or that of respecting clients' wills," Privacy Commissioner Ada Chung said. The PCPD also identified deficiencies in Fotomax's data security measures it said led to a ransomware attack.