Privacy law changes to be put forward
Amendments to the much criticised privacy law will be put before the legislature by November, because the existing law does not meet the public's expectations, Chief Secretary Henry Tang Ying-yen said yesterday.
This follows the uproar over the disclosure that Octopus cardholders' personal data had been sold to third parties for HK$44 million, and the card issuer's assertion this was legal.
'We note the existing law is falling short of public expectations,' Tang said. 'The recent incidents have raised public awareness of privacy protection, which requires joint efforts by the government, the public and the trades.
'The government will put more effort into privacy protection and will give clear guidelines to various industries.'
He said the government had discussed improvements with Privacy Commissioner Allan Chiang Yam-wang and proposals would be put to the Legislative Council soon.
The government is studying the possibility of making the unauthorised use of personal data a criminal offence and giving more power to the privacy commissioner to help victims of such breaches take their cases to court.
A spokeswoman for the privacy watchdog said the investigation of the Octopus affair was expected to be completed in September, and the Octopus Cards company would then have 28 days to respond to the report.
The Octopus card's broad reach has made it a popular way to pay transport fares and shop at retail chains. Nineteen out of 20 Hongkongers have the smart card, and more than 2 million hold a personalised one. But the Octopus' many tentacles allow it to collect a broad range of data about its users' day-to-day activities.
In June, Octopus Cards said it would stop storing card holders' ID numbers on their personalised cards after political group New Forum pointed out the company's privacy policy allowed it to freely transfer card holders' personal data to its business partners. Amid a growing row, the company announced a month later it would stop sharing the data, and a day later confessed it had pocketed HK$44 million from selling the data of 1.97 million card holders.
The privacy watchdog is also investigating five complaints against three telecommunications operators over the transfer of customers' personal data to other companies. And the Hong Kong Monetary Authority recently said some banks had sold customers' data to insurance firms.
The government consulted the public last year about changing the privacy law, but nothing came of it.
The Constitutional and Mainland Affairs Bureau said yesterday it would publish proposed changes to the law.
'We will listen to the views of Legco members, relevant stakeholders and members of the public before putting forward a legislative amendment,' a spokeswoman for the bureau said.
Lawmaker James To Kun-sun said there was still a need to consult the public about the review of the privacy law. 'Many businesses are fearful about what kind of regulations might be coming up, so it is good to give them a chance to express their concerns.'
Not for sale
The Octopus affair sparked an outcry over selling of personal data
Amount Octopus Cards made from the sale of cardholders' data, in HK$: $44m
