I don't suppose Prudence Chan Bik-wah is paying too much attention to the newspapers these days but, just in case she is, here are a few words in a more sympathetic tone than others she has been hearing lately.
First, let's be clear that the vast majority of Octopus card users are not in any danger of having their personal details passed on to others because they have never given the company any information. They, like me, have simply bought a card and used it as a terrifically efficient tool to facilitate everyday life. You can use it to travel by most forms of public transport, park in most car parks, and make purchases in supermarkets or convenience stores. And no one will know anything about you.
But a minority of users has signed up for some additional benefits such as eligibility for rewards. In the process they have provided information about themselves and also given a waiver about how that information could be used. It may have been in small letters, but a waiver there was and they signed it freely. There are no grounds for them to complain.
Second, Octopus has done no more or less than many - maybe most - other companies which provide some sort of added service. Do you have an oil company customer discount card, an airline loyalty card with special benefits, a supermarket points card providing cheaper prices, a hotel privilege card? If you do, chances are that the company which issued the card is also making use of the data to pursue a commercial advantage. Wake up, people, that's what companies do. You get something; they get something. If you don't want them using your personal data, don't give them any and don't apply for the card. Or take the trouble to read the conditions thoroughly and opt out of the clauses authorising them to pass on your information to other parties. It's really that simple.
If all the facts ever come out, then it is likely we are dealing with many different companies and hundreds of millions of dollars, and the Octopus company's HK$44 million will seem a drop in the ocean.
Third, it is inconceivable that the directors of the company did not know what was going on. Where did they think the millions were coming from? Let us put the question as clearly as we can: what did the directors know, and when did they know it?