Octopus must come clean

YESTERDAY the board of Octopus Holdingshad a special meeting. Lincoln Leong, itschairman, said afterwards the board hadaccepted Octopus chief executive Prudence Chan'sresignation, resolved that the company return to itscore as an electronic money system and decided thatthe $44 million it had earned by selling its customers'personal data be donated to the Community Chest.

Few would say Prudence Chan need not haveresigned. It is open to discussion whether it is right tosell customers' personal data. Accusing fingers havebeen pointed at her because she attempted tohoodwink the public with a lie soon after the affair hadcome to light. She is bankrupt in credibility, andOctopus's image has been badly damaged.Accountability being the in thing now, Prudence Chancertainly had to take the blame. However, is it true thatno other Octopus director is to blame? Judging fromwhat has happened, that is an open question.

One may say the affair took a turn when PrudenceChan dragged the MTR Corp's board in. It is believedthat the MTR Corp and the government have dumpedPrudence Chan to save themselves. They havebehaved like a house lizard, which loses its tail whenalarmed. Prudence Chan will not immediately leaveOctopus though she has resigned. She has givenOctopus six months' notice as stipulated in hercontract. In other words, she will remain with thecompany and get her fat pay for six more months.Meanwhile, David Tang, a top MTR Corp executive,will do her job. There is no way any outsider canfathom the mystery of those arrangements. However,one is at least certain that she has neither got the sacknor taken the blame. She would have to goimmediately in either case.

Octopus broke no laws when it sold its customers'personal data. However, it does not follow that itbehaved reasonably or sensibly in doing so. When theaffair came to light, all were outraged. Rarely in recentyears have citizens been in such agreement about anyissue. People of all political complexions, all ages andboth sexes have condemned Octopus. It can thus beseen that its perverse behaviour has aroused publicindignation. However, Octopus has broken no laws.The affair has in fact laid bare the loopholes in thePersonal Data (Privacy) Ordinance. Citizens are nowaware that the ordinance alone does not protect theirprivacy.

Octopus's new management must fully disclosehow the company has obtained and used citizen'spersonal data before it can regain the public's trust.The affair began when Octopus Rewards Programmeparticipants suspected their personal data had beenleaked. However, it remains to be clarified whetherOctopus has transferred only Octopus RewardsProgramme participants' personal data. Octopus hasadmitted it has sold data to six companies. As itrefuses to make public any documents concerningthose deals, citizens are worried that the conditions ofthose transactions might have even more gravelyharmed their interests. Octopus has analysed citizens'personal data to dicover patterns of consumerbehaviour. It has sold such information to companiesthat need it. How much of such in-depth informationhas it sold? What can be done to undo the harm suchsales have done citizens? Octopus must deal with theaftermath of the affair. It ought to come up withmeasures that may help reassure the public.

The Octopus system was born in Hong Kong. It isa huge success. People from other places have comehere to learn from Octopus's experience. However, itsimage has worsened because it has sold customers'data for profit. The company has a peculiarbackground. For example, the government supports itwith policy, and its shareholders are mainly publictransport operators. It is to some extent a "publicbody". It has much to do with citizens' lives. That iswhy Octopus's fall is the last thing we want to see. Wehope that, when it is better managed, it will thoroughlymake clear everything about its sales of personal data,undo the adverse effects of the affair and againburnish its image, which was once golden.

明報社評

2010.08.05

全面交代出賣私隱真相八達通才可重獲市民信任八達通董事會召開特別會議之後，主席梁國權宣布接受行政總裁陳碧鏵辭職、確立回歸電子貨幣的業務方向，並把出賣客戶個人資料所得4400 萬元利潤，捐給公益金等。

陳碧鏵之辭職，各方並無太大異議。關於出賣客戶資料的是非對錯，原本有可以討論的空間。在此事上，陳碧鏵遭受千夫所指，主要是她在事件揭發之初，一度說謊，企圖欺騙市民，其個人誠信破產，也使八達通這塊金漆招牌蒙塵。在問責文化當道的今日，陳碧鏵需要負責，是一定的了，但是八達通董事會其他人就毋須負責？就事態而言，見仁見智。

可以這樣說，陳碧鏵把事態燒向港鐵董事會，乃此事的轉捩點。陳碧鏵之去職，被認為是港鐵和政府「棄車保帥」、「斷尾求生」的招數。事實上，陳碧鏵辭職後，並未立即離開八達通，而是按合約給予公司6 個月通知期，亦即會多留6 個月，繼續支取高薪。其間，港鐵是會派出高層人員鄧智輝暫代陳碧鏵的職務。這些安排有何玄機，外界無從猜度，但是起碼可以確認的是：陳碧鏵並非被八達通解僱，她也並非承認錯誤後辭職，因為若屬這兩種情况，其辭職應該即時生效，而非現在的拖泥帶水。

八達通出賣客戶個人資料，即使合法，不等於合情合理。事件揭發之後，各方面對八達通做法的強烈反應，是近年來，輿情就單一事態少有的高度一致，政治上不分左中右，人不分男女老幼，都一齊加入聲討，可見出賣客戶個人資料之乖離尋常情理，已經激起民憤。但是八達通的做法，卻是合法的，事態其實把私隱條例的漏洞，充分地暴露出來，讓市民認識到單憑現行法例，不能保障私隱。

另外，八達通新管理層要挽回市民的信心和信任，必須完整交代八達通所擁有和使用市民私隱資料的全部情况。這次事件，由八達通日日賞客戶懷疑個人資料被泄露而起，不過，情况是否僅止於日日賞客戶，仍待釐清；其次，八達通承認把資料出賣給6 家公司，交易條款有否進一步損害了市民利益，由於八達通不允公開相關文件，市民疑慮甚深；第三，八達通按市民私隱資料，分析出其消費行為和模式，然後賣給有特定需要的客戶，這些「深度」私隱資料，八達通出賣了多少？如何消除它對市民構成的損害，八達通要拿出使市民安心的善後措施。

八達通是本港自創品牌，其成功經驗，許多國家地區都來取經仿效，讓港人引以為傲，這次出賣市民客戶個人私隱資料牟利事件，使八達通的形象一落千丈。這家公司的特別背景，例如政府以政策扶持、其股東主要為本港的公共交通機構，某一程度上，八達通算得上是一家「公共機構」，與市民生活關係密切，職是之故，我們絕對不願看到八達通一沉不起，期望它在改善公司管治之後，徹底釐清出賣客戶個人資料情况，然後回歸電子貨幣本業，掃除這次事件的負面影響，重新擦亮八達通這塊金漆招牌。

G lossary

the sack

If you get the sack or are given the sack, youare fired from your job.

perverse /p ?'v ?:s/

which most people do not expect and think iswrong.

lay bare

If you lay something bare, you expose or revealit.

每周一音標

《明報英語網》逢星期二推出「每周一音標」，以視像短片模式教授國際音標，真人發音，歡迎瀏覽網址：english.mingpao.com