Plugging privacy loopholes

Octopus Cards has pledged to donate to charity the HK$44 million worth of proceeds accrued from sales of clients' personal data to third parties.

It's unclear how far this will help soften the public outcry, as some politicians will surely continue howling for blood.

Nevertheless, the donation is a goodwill gesture.

The Octopus saga had been simmering for a while, but started boiling over after chief executive Prudence Chan Pik-wah gave inconsistent accounts of the company's handling of the data.

As a result, it has cost her the CEO's job, although she's staying on during a six-month transitional period.

Indeed, it's rather common practice in the business community for companies to treat clients' data as an asset, and to use it to generate revenue.

I'm sure many people have experienced receiving cold marketing calls from strangers claiming to be representing such and such a firm that had never been heard of before. In the end, the recipient is left wondering how the telemarketers managed to get his or her telephone number.

Selling data is nothing new here or elsewhere. To a certain extent, access to such information can help firms start up quickly rather than having first to undertake onerous efforts in building up a database. Economists say this plays an important role in aiding legitimate economic activities.

As the Octopus saga shows, people who may not have minded such information sharing in the past are finding it hard to accept nowadays, as they become more conscious of privacy rights.

The government is currently in the midst of reviewing the Personal Data (Privacy) Ordinance, and new privacy boss Allan Chiang Yam-wang will likely be given greater powers to protect people's privacy. Among a wide range of issues, the review covers marketing activities, using personal data.

It has been set out as a principle in the review that any changes to the privacy law should not undermine the SAR's competitiveness and economic efficiency as an international city. This is an important principle. But will the public anger triggered by the Octopus fiasco shift the balance away from this principle when society is again engaged in the discussion during the second stage of consultation? The next round of debate will be launched in the fall.

It's certainly a shift to guard against, and a fine line will have to be found for the best possible balance.

Unfortunately, there are no universally agreed sets of personal data being subject to different protection levels. But the data can still be grouped into being sensitive and less sensitive.

In the European Union, personal information such as racial and ethnic origin, political opinion, religious or philosophical beliefs, trade union affiliations, health and sex life is considered sensitive, and given the highest degree of statutory protection.

There is no question that in Hong Kong, sensitive personal data should be subject to the strictest codes too.

英文虎報
Central Station | By Mary Ma