The inconvenient truth

The Octopus saga over the selling of cardholders' personal data can well be summed up as "asking for it."

I'm not trying to be rude or crude, but from the very start, it was a total public relations disaster.

Instead of coming clean, Octopus Group chief executive Prudence Chan Pik-wah tried to wriggle her way out with words - a big no-no.

She was accused of lying soon after her first public statement on July 20. As if not enough damage had been done, Octopus issued a statement on the eve of a privacy commission inquiry that the company was discussing ways to terminate contracts signed with the two merchants that had been sharing its customers' data.

After a week of squirming, Chan shocked and angered her 2.4 million cardholders when she admitted at the hearing her company, Octopus Holdings, provider of electronic- payment services, had been paid HK$44 million since January 2006 for disclosing personal information on clients.

She also revealed that during the 4-1/2 years ended June 30, Octopus provided the personal particulars of 1.97 million customers to six companies, including an insurance firm, Cigna.

Chan also admitted Octopus is contracted to provide a certain amount of customer data to Cigna, and when customers buy products from the insurer, Octopus reaps a commission.

So, finally the truth - or at least part of it - was flushed out at yesterday's hearing. Why did it take so long?

Chan can't be that naive to think she can fool her millions of customers by trying to sweep the truth under the carpet. Octopus Cards started off as a convenient method to buy MTR tickets, pay for bus and tram rides, fast-food meals and convenience-store products.

With high-technology, Octopus has became an access card for schools and buildings, as well as credit cards. It has a huge market, and many establishments, be it telecoms or insurer, covet clients' personal data in order to market and boost their businesses.

Certainly, the incident has sparked considerable concern. Cardholders and the general public are worried that they have no way of knowing whether their personal data has been sold.

Besides the privacy commission, the Hong Kong Monetary Authority has also ordered Octopus Cards to submit a report on the issue.

The report should be prepared by external auditors, to be appointed by the company, and approved by the authority. The Monetary Authority action couldn't have come at a better time. But the government still ought to step in to try to plug any gray areas to ensure the public that their personal data is safe.

And MTR Corp - the biggest Octopus shareholder - has to do a lot more to reassure the public than just asking the card company to take the issue seriously.

Action is needed before the evil dollar starts to rear its ugly head.

英文虎報
Central Station | By Mary Ma