The operator of a Hong Kong cashless-payment system has come under fire after it reversed itself and admitted to selling the personal data of nearly two million customers to business partners, sparking demands for better regulation of how personal information is handled.
Late Monday, Octopus Holdings Ltd. said it earned about 44 million Hong Kong dollars (US$5.7 million) over 4 1/2 years from the sharing of personal information with six companies for marketing purposes. Earlier, the private company denied any such sale took place.
A Hong Kong privacy law regulates how such data should be collected and used, but it doesn't forbid sharing it with third-party companies. At issue is whether Octopus acquired consent from its clients to share their data and whether more personal data was shared than necessary.
Octopus's chief executive, Prudence Chan, said Tuesday that her earlier comments that Octopus hadn't sold client data to third parties were erroneous because of a lack of available information at the time.
'We acknowledge that the situation hasn't been handled well,' Ms. Chan told lawmakers at a hearing. 'What we said [earlier] didn't fully reflect the truth, and for that we apologize to the Hong Kong public.'
She said the company has suspended all such marketing partnerships in a bid to 'regain public confidence.'
Since its launch in 1997, the 'Octopus card,' effectively a stored-value account, has brought cashless payments to many facets of Hong Kong life, allowing people to ride public transportation, pay bills and buy groceries with the wave of a small plastic card. The system handles an average of 11 million financial transactions each day, valued at about HK$100 million.
Octopus is owned by a consortium of Hong Kong's public-transport operators, including rail operator MTR Corp., which holds a 57% stake.
Concerns about how Octopus handles client data emerged in June when an opinion poll by a political group found that more than 90% of respondents said they hadn't read the personal information statements when they provided data to apply for Octopus services.
The survey caught the attention of the city's privacy commissioner, who last week launched a formal investigation to determine if the company's use of client data may have contravened certain requirements under the privacy law.
'I have nothing against direct marketing as a commercial activity,' Privacy Commissioner Roderick Woo told lawmakers at the hearing Tuesday. 'My concern is only on how we can lawfully deal with the protection of personal data.'
Mr. Woo said one focus of his investigation is whether people who provided data were informed about the use of their information when collecting the data. He said a preliminary report should be ready by Saturday, his last day as privacy commissioner before stepping down.
Octopus spokesman Donald Cheung said the company is 'committed to protecting the personal information and privacy of customers, abiding by the Personal Data [Privacy] Ordinance and the terms and conditions of all customer agreements.'
He said the company's application forms clearly state how it handles and uses personal information, and it uses information with the consent provided by the clients in those forms. The company has launched its own inquiry on how it handles personal data.
Bloomberg News周二，一名乘客在香港一地铁站使用八达通卡周一晚间，八达通控股有限公司(Octopus Holdings Ltd.)说，在以市场推广为目的与六家公司分享客户个人信息的四年半时间里，共获得了约4,400万港元（合570万美元）。此前，这家私人公司曾否认有任何此类出售客户资料的行为。