Three people alleged over the weekend that a University of Hong Kong (HKU) law student fabricated pornographic images of at least 20 women using artificial intelligence, in what is the first high-profile case of its kind in the Chinese financial hub.

The university sparked outrage over a perceived lenient punishment after it said Saturday it had only sent a warning letter to the student and demanded he apologise.

But Hong Kong's Office of the Privacy Commissioner for Personal Data said Tuesday that disclosing someone else's personal data without consent, and with an intent to cause harm, could be an offence.

The watchdog "has begun a criminal investigation into the incident and has no further comment at this stage", it said, without mentioning the student.

The accusers said in a statement Saturday that Hong Kong law only criminalises the distribution of "intimate images", including those created with AI, but not the generation of them.

There is no allegation so far that the student spread the deepfake images, and so "victims are unable to seek punishment... through Hong Kong's criminal justice system", they wrote.

The accusers said a friend discovered the images on the student's laptop.

Experts warn the alleged use of AI in the scandal may be the tip of a "very large iceberg" surrounding non-consensual imagery.

"The HKU case shows clearly that anyone could be a perpetrator, no space is 100 percent safe," Annie Chan, a former associate professor at Hong Kong's Lingnan University, told AFP.

Women's rights advocates said Hong Kong was "lagging behind" in terms of legal protections.

"Some people who seek our help feel wronged, because they never took those photos," said Doris Chong, executive director at the Association Concerning Sexual Violence Against Women, referring to cases at the group's crisis centre.

"The AI generations are so life-like that their circulation would be very upsetting."

Asked about the case at a Tuesday press briefing, Hong Kong leader John Lee said most of the city's laws "are applicable to activities on the internet".

HKU said on Saturday it will review the case and take further action if appropriate.