Privacy right calls for careful balance
It is as if the Octopus Card scandal last year never happened. Octopus owned up to selling the personal details of more than a million customers to business partners and tried to make amends by donating the HK$44 million profit to charity. Even before then, most people would have expected their personal data to be safe in the hands of a bank, and not for sale to other companies without agreement for uses unrelated to banking. The privacy commissioner says this is what has happened at Citibank, Fubon and Wing Hang banks, and the Industrial and Commercial Bank of China (Asia). Tens of thousands of clients were involved, rather than millions, and the four banks eventually rectified the situation and promised compliance with privacy practice.
They tried to rely on a clause on customer forms informing clients that their personal data could be used for other marketing purposes, an argument rejected by privacy commissioner Allan Chiang Yam-wang because there was no prescribed consent nor proper explanation of the terms.
This defence also gained little traction during the Octopus controversy. The government rightly proposed more transparency, including a separate provision in sales and service agreements to opt out of disclosure of personal data to third parties. The Direct Marketing Association opposed the 'unbundling' of consent from other terms of sales and service deals, with chairman Eugene Raitt insisting it was the consumer's responsibility to read the terms before signing.
Sadly, many of us rarely spend enough time reading the fine print, but privacy should not be sacrificed by default. The government's proposed package of measures to better protect it also included making unauthorised sales and breaches of rules of disclosure criminal offences punishable by imprisonment and heavy fines. The latest case is a reminder that reforms are urgently needed. Direct marketing contributes to our vibrant business environment and creates jobs. The legal sale of customer lists is part and parcel of it. But a careful balance must be struck with our core value of the right to privacy.