Guarding against abuse of personal data in the public domain
Allan Chiang says Hong Kong law protects us against the misuse of personal data already in the public domain, a provision that those seeking to reuse such data would do well to understand
Many people believe personal data collected from the public domain - such as the companies, land and vehicles registers, the government gazette, and even the internet - is open to unrestricted use. This view is incorrect.
Personal data, whether publicly available or not, is protected under the Personal Data (Privacy) Ordinance. Imagine the consequences if the opposite were true. Data users may get around the law by deliberately publicising the data in the public domain, and the improper use of personal data that was leaked to the public domain would be legitimised.
Technology has exacerbated the risks of a loss of privacy. Advances in the aggregation, matching and further processing of personal data in the public domain means such data mining is now conducted with phenomenal ease and efficiency. For those who know how, it is easy to profile an individual and generate new uses of the data beyond the purposes for which they were initially collected.
Admittedly, such profiling could generate economic and societal benefits. But at the same time, it poses grave privacy risks.
One example of these risks is the use of personal data to market goods and services. In a report last year, the US retail giant Target was found to have analysed the purchasing habits of its customers so closely that it was able to guess reliably whether a female customer was pregnant and by how many months. In one case, the father of a teenage girl found out that she was three months pregnant after his suspicions were raised due to the increased amount of pregnancy-related adverts from Target arriving in the mail. The fact Target had "data-mined" its way into a customer's womb is clearly intrusive.
It is conceivable that many marketers are using innovative analytics to enhance marketing effectiveness based on data supplied by the customer and data in the public domain. The problem is not so much related to the nature and source of the data but, rather, to the way the data is combined, further processed and used.