2010-10-22 updated　　　　　　　　　　　　　　　　過往內容 >>

The company that runs Hong Kong’s Octopus card system escaped punishment, even though an official investigation has found it broke privacy laws by selling customer information to other companies. The Privacy Commissioner’s Officer says there’s nothing it can do about it and is asking for more powers to tackle such matters. After an investigation that lasted three months Privacy Commissioner Allan Chiang announced this morning that the people running Hong Kong’s Octopus card system had violated laws that protect people’s privacy. And what can he do about it? Pretty much nothing. “I have no power to award a penalty against Octopus.” Octopus Cards Ltd was exposed in July this year for selling the personal details for customers using its loyalty program. Octopus Rewards, to other companies for profit. Octopus CEO Prudence Chan initially denied the allegations, but later admitted the company had made at least $44 million form selling the personal information of 2.4 million customers over for-and-a-half years to at least five companies. Accused of lying and covering up the scandal, Chan has quit and will leave the company next February. The privacy commissioner said today Octopus had violated the Personal Data (privacy) Ordinance on three levels. The company collected excessive personal data from customers when there was no need to. It failed to take “all reasonably practicable steps” to inform customers about their data being passed on. And it shared that data with its business partners for monetary gain without getting customers’ consent. “Sale of personal data although not prohibited by the ordinance, is not explicitly spelt out in the terms and conditions of this rewards scheme. So a signature on the registration form given by the customer cannot be regarded as a true, explicit and voluntary consent on the part of the customers to give away the customers’ (data) to third parties so that Octopus can gain in terms of monetary rewards. Chiang accused Octopus for cheating its customers as it allowed business partners to call them up claiming the were Octopus employees. The privacy commissioner could have issued an enforcement notice against the company to make sure it never leak customer data again, but he’s not doing this because he needs proof that Octopus will break the law again. “I have actually obtained a written undertaking from Octopus to the effect that they will not repeat the mistakes that they have made. So basically this serves the same purpose as the enforcement notice.” The fact remains that Octopus is getting away with a slap on the wrist and the privacy commissioner knows this, which is why he wants greater powers. “I personally feel that this is not adequate because we are not giving any penalty to people who have made mistakes, but this is what is the present provisions under the ordinance. So I would have hope that the ordinance would be reviewed to strengthen regulations to increase the penalty. His office has published new guidelines for direct marketing companies so that they will not violate privacy laws. “It’s more comprehensive, you know. It provides real examples. It incorporates recent developments in the interpretations of the ordinance.” The Privacy Commissioner’s Office has already told Octopus to wipe out its customer database and be more transparent with its information handling procedures. Octopus itself has conducted a three-month comprehensive review on the way it handles such information. The company has deleted customer information it deemed non-essential form its database, and donated the money it earned from selling that information to the Community Chest.

The company that runs Hong Kong’s Octopus card system has revealed it made nearly $58 million by selling customers’ personal information without their consent. The chairman of the company announced his resignation today but denied it had anything to do with the scandal. A day after the privacy commissioner’s report that found Octopus Holdings hand deceived customers and reaped profits by selling their data without their consent, the company had a big announcement to make. “I will be retiring as non-executive chairman of Octopus Holdings and Octopus Cards on 31st December this year.” But chairman Lincoln Leung denied he was leaving because of the data-selling scandal. “I would say that it is purely a retirement. I have been non-executive chairman for getting on to nine years, which is a long period of time to be non-executive chairman of any company. It has really been my honour to have been the non-executive chairman for this period of time. He will be replaced by former HSBC chairman John strickeland. Octopus CEO Prudence Chan who stepped down earlier, has taken all the flak for the scandal, but there have been concerns that she was made a scapegoat and people higher up than her, including MTRC board members who oversee Octopus, should have been held accountable. The company also revealed today that it had made much more money than earlier estimated by selling customers’ personal information without their consent to other companies “HK$57.9 million, which represents 1.6 percent of Octopus’ total revenue in that same period.” The company has already donated $44 million – the original amount estimated – to the Community Chest. The balance of $13.9 million will also be given to charity. Octopus has also promised to accept the privacy commissioner’s recommendations along with those made by the HKMA and its own internal investigation. It will stop selling customer data to marketing companies and refocus on its core business – an electronic payment system. Octopus will also inform its customers of their right to opt out of any schemes which would involve the transfer of personal data. A new registration from will show terms and conditions in larger print. It will also delete sensitive information, such as identity card numbers and birth dates. The company says it has been assured by its business partners which received such information that the data has been or will be deleted. Octopus will appoint a data privacy officer, who will be personally in charge of customers’ personal information. But it will continue with its Octopus Rewards scheme, the loyalty programme that was at the centre of the scandal. The outgoing chairman fired a parting shot. “We do not agree with all the findings of the privacy commissioner in his report. We have received different legal views on this report.”

The Observatory has raised the standby signal number one as severe Typhoon Megi edges closer to Hong Kong. Forecasters don’t expect a higher signal tonight, but say winds will strengthen in the next few days as the storm comes closest to the city over the weekend. After lashing the Philippines earlier this week, leaving 10 people dead. Severe Typhoon Megi is set to bring a wet and windy weekend to Hong Kong.“Severe typhoon started to move north slowly in the afternoon edging closer to the South China coastal region” Megi’s track has been unpredictable but forecasters expect winds to gain in strength in the coming days. “Under the combined effect of the northeast monsoon and Megi, winds over Hong Kong generally will strengthen in the next couple of days and there will also be swells over the seas. If you look at the satellite pictures we can see the outer rainbands of Megi. In the next couple of days, we will start to be affected by the outer rainbands of Megi and the weather in the next couple of days is that winds will strengthen in the next couple of days … and also there will be heavy rain and squalls. According to the present track, the chance of strong wind signal number three tonight is not high. Winds of up to 18 kilometres per hour were recorded in Tsing Yi. That led to the closure of the upper deck of the Tsing Ma Bridge. Megi, which means catfish in Korean, has generated wind speeds of up to 175 kilometres per hour at its centre. It is the strongest typhoon to affect the region since 1990. Megi has already brought heavy rain to Taiwan, especially the eastern counties of Ilan and Hualien. These tourists were trapped while visiting Ilan. Rescuers tried to reach them with a rubber boat, but the currents were so strong that it capsized. The rescuers almost got washed away as well. After a whole day’s worth of effort, rescuers managed to get the tourists out. Nearly 1,000 millimetres of rain is expected to fall on Taiwan as Megi approaches. Mainland authorities are taking no chance as well. The Ministry of Civil Affairs and the State Disaster Relief Commission has ordered civil affairs departments to prepare for the storm. Hainan’s meteorological centre has issued red alerts, the highest level, for four cities, including the provincial capital of Haikou. The province just recently experienced a bout of torrential rain and serious floods. All fishing vessels in the provinces of Fujian, Guangdong and Hainan have been ordered to return to port. At least 140,000 people have been ordered to move away from fold-prone areas. Hydroelectric power stations have been put on alert as well. The strength of the typhoon means it will remain a threat even after it makes landfall. Megi is expected to bring heavy rain to eight provinces in the south – Hainan, Guangdong, Fujian, Yunnan, Guizhou, Jiangxi and Hunan. Flooding could also be especially serious as the region will be affected by large tides at the same time.