【英语中国】香港八达通出售客户资料遭炮轰

The operator of a Hong Kong cashless-payment system has come under fire after it reversed itself and admitted to selling the personal data of nearly two million customers to business partners, sparking demands for better regulation of how personal information is handled.

Late Monday, Octopus Holdings Ltd. said it earned about 44 million Hong Kong dollars (US$5.7 million) over 4 1/2 years from the sharing of personal information with six companies for marketing purposes. Earlier, the private company denied any such sale took place.

A Hong Kong privacy law regulates how such data should be collected and used, but it doesn't forbid sharing it with third-party companies. At issue is whether Octopus acquired consent from its clients to share their data and whether more personal data was shared than necessary.

Octopus's chief executive, Prudence Chan, said Tuesday that her earlier comments that Octopus hadn't sold client data to third parties were erroneous because of a lack of available information at the time.

'We acknowledge that the situation hasn't been handled well,' Ms. Chan told lawmakers at a hearing. 'What we said [earlier] didn't fully reflect the truth, and for that we apologize to the Hong Kong public.'

She said the company has suspended all such marketing partnerships in a bid to 'regain public confidence.'

Since its launch in 1997, the 'Octopus card,' effectively a stored-value account, has brought cashless payments to many facets of Hong Kong life, allowing people to ride public transportation, pay bills and buy groceries with the wave of a small plastic card. The system handles an average of 11 million financial transactions each day, valued at about HK$100 million.

Octopus is owned by a consortium of Hong Kong's public-transport operators, including rail operator MTR Corp., which holds a 57% stake.

Concerns about how Octopus handles client data emerged in June when an opinion poll by a political group found that more than 90% of respondents said they hadn't read the personal information statements when they provided data to apply for Octopus services.

The survey caught the attention of the city's privacy commissioner, who last week launched a formal investigation to determine if the company's use of client data may have contravened certain requirements under the privacy law.

'I have nothing against direct marketing as a commercial activity,' Privacy Commissioner Roderick Woo told lawmakers at the hearing Tuesday. 'My concern is only on how we can lawfully deal with the protection of personal data.'

Mr. Woo said one focus of his investigation is whether people who provided data were informed about the use of their information when collecting the data. He said a preliminary report should be ready by Saturday, his last day as privacy commissioner before stepping down.

Octopus spokesman Donald Cheung said the company is 'committed to protecting the personal information and privacy of customers, abiding by the Personal Data [Privacy] Ordinance and the terms and conditions of all customer agreements.'

He said the company's application forms clearly state how it handles and uses personal information, and it uses information with the consent provided by the clients in those forms. The company has launched its own inquiry on how it handles personal data.

Jeffrey Ng

香港一家无现金支付系统运营商日前改口，承认把近200万客户的个人信息卖给了商业合作伙伴，进而遭到了猛烈抨击，引发了人们要求加强对个人信息管理监管的呼声。

Bloomberg News周二，一名乘客在香港一地铁站使用八达通卡周一晚间，八达通控股有限公司(Octopus Holdings Ltd.)说，在以市场推广为目的与六家公司分享客户个人信息的四年半时间里，共获得了约4,400万港元（合570万美元）。此前，这家私人公司曾否认有任何此类出售客户资料的行为。

香港的一项隐私权法负责监管此类信息的收集和使用，不过并不禁止与第三方公司分项此类信息。争论的焦点是，八达通在分享个人信息方面是否获得了客户的同意，以及分享的个人信息是否比必要的多。

八达通行政总裁陈碧铧周二说，她此前有关八达通没有向第三方出售客户资料的说法有误，因为当时缺乏足够的信息。

陈碧铧在听证会上对立法会议员说，我们承认事情没有得到很好的处理，我们此前说的没有完全反映出事实，对此，我们向香港公众道歉。

她说，公司已暂停所有此类市场推广合作关系，以期重获公众的信任。

自1997年推出以来，八达通将无现金支付带到了香港生活的很多领域，人们可以用一张小小的塑料卡乘坐公共交通、付帐单、买东西。八达通卡实际上是一种储值帐户。这个系统每日平均处理1,100万金融交易，总额约为1亿港元。

八达通隶属于香港公共交通运营商组成的一个财团，其中包括铁路运营商香港铁路有限公司(MTR Corp.)，它持有八达通57%的股权。

对八达通如何处理客户资料的担忧始现于6月份，当时一个政治组织进行的民意调查显示，有90%以上的受访者说，在提供个人资料以申请八达通服务时，没有看个人资料声明。

调查引起了香港个人资料私隐专员的注意，他上周发起了一项正式调查，以便确定八达通对客户资料的使用是否可能违反了隐私权法的某些要求。

个人资料私隐专员吴斌周二在听证会上对议员们说，作为一种商业活动，我并不反对直接的市场推广，我担心的只是我们能够怎样合法地处理个人资料的保护问题。

吴斌说，调查的一个关注点是，人们在提供个人资料时是否被告知了资料的使用情况。他说，周六前应该会准备好一份初步报告。周六将是他担任个人资料私隐专员的最后一天，之后他将卸任。

八达通发言人Donald Cheung说，公司致力于保护客户的个人资料和隐私权，遵守《个人资料（私隐）条例》，以及所有客户协议里的条款和条件。

他说，公司发出的申请表明确说明了个人资料的处理和使用，公司是在客户在申请表中表示同意的情况下使用客户资料的。八达通已经就如何处理个人资料发起了自己的调查。

Jeffrey Ng