Octopus Cards will stop sharing cardholders' personal data with its business partners provided the cardholders specify upon joining a reward scheme that they do not wish to receive promotional materials. The move comes after a political group raised concerns last month as to whether the company freely transferred, or even sold, cardholders' information to its business partners. Octopus Cards chief executive Prudence Chan said users' consent was always obtained before their personal details were shared with the company's business partners. It does not sell the data, which is used for the marketing of goods and services. 'We are considering adding an option in the application form for the reward scheme where people can choose not to receive our partners' promotional material,' she said. About 2.4 million Octopus cardholders have signed up for a reward scheme that offers benefits at the firm's business partners, including supermarkets and shopping malls. Any Octopus cardholder can apply for the scheme with his or her name and contact details. About 10 per cent of the 20 million Octopus cards are personalised ones that contain the holder's name, contact details, identification document type and number, age and date of birth. The rest of the cards do not contain that information. The company called a news conference yesterday after privacy concerns escalated as lawmaker Wong Kwok-hing questioned what had happened to cardholders' personal data after Octopus Rewards, an Octopus Cards subsidiary that used to handle the data, closed last year. Chan said the data no longer existed upon the subsidiary's closure, but Wong demanded the Hong Kong Monetary Authority and the privacy commissioner launch an investigation. Both authorities said they would follow up on the issue. Octopus Cards promised to stop storing the ID numbers of holders of personalised cards on their cards, starting from the fourth quarter of this year. Holders of existing cards who would like their ID numbers removed must call the company. Fears began to spread after a man complained to the privacy commissioner last month that his name and address were shown on a screen when he put his personalised Octopus card on a card reader to gain access to his residential block. Chan said Octopus Cards only sold card readers to the building's management company, which had entered the residents' data into its system. 'The card carries no information as to where you have gone or when you went to play ball games,' she said. Chan said the card does not record where users do their shopping, either. 'We know which store you shop in and the amount you spent, but we don't know what items you bought or where that store is - this information is held by the stores,' she said. 'We, meanwhile, hold the card users' personal details. If our partners want to offer benefits to our cardholders, we will notify them.'
