Only two of Octopus Cards' 23 business partners possessed the private data of the 2.4 million cardholders who joined a reward scheme, the city's largest card issuer said yesterday.
However, lawmakers who failed to obtain details of those transactions - including the issue of whether any monetary gain was involved - were unhappy about the limited disclosure and asked the Legislative Council to scrutinise the issue formally.
Octopus Cards chief executive Prudence Chan Pik-wah said no new contracts of data sharing would be signed while a special committee comprising the company's non-executive directors reviews its policies on usage of private data in the next three months.
The committee was set up yesterday after a cardholder's complaint over Octopus' handling of his private information threatened to turn into a full-blown credibility crisis, with the privacy commissioner and the Hong Kong Monetary Authority stepping in.
Roger Luk Koon-hoo, a former managing director of Hang Seng Bank and a non-executive director at Octopus Holdings, will chair the committee.
It will examine whether the company's data privacy policies are in line with international practices and recommendations will be made on how customers' data privacy can be better protected.
At a media briefing, Chan did not say if Octopus' two insurance company partners - Card Protection Plan and Cigna - had paid for the cardholders' data, but stressed that it would stop sharing the information with other merchants while the committee conducted the study.