The outcry about the use of personal data by Octopus Card Limited continues to grow, with more allegations and disclosures concerning misuse of data.

The latest furor appears to have erupted after a man involved in a fare dispute with a green mini-bus driver complained that the driver was able to obtain personal information from the Octopus card the passenger had used to pay his fare.

Anecdotes such as this serve to demonstrate that people don't understand the risks entailed, says Central and Western District Councilor Dominic Chan. He believes the disclosure statements by Octopus are too vague, especially given that people have tied their Octopus cards to their bank accounts and shopper's reward programs.

"We are asking the company to act responsibly since it collects and keeps vast amounts of data that they can pretty much do anything they like with," Chan said.

Citing the card's personal data policy, Chan pointed out the personal data of card holders could be used for the "marketing of goods and/or services" by "selected business partners" and "other purposes".

With more than 20 million cards in circulation, daily transactions now exceed 11 million. When the Octopus Card is tied to bank accounts, personal contact information is vulnerable, over and above the fact the cards are capable of keeping track of a person's traveling and transaction records.

The all-encompassing vagueness of the term "other purposes" spooked Chan, who said the company at the very least should tell card holders the far-reaching implications.

He also hit out at provisions permitting the company to use personal data for direct marketing. Card holders automatically consent to this, unless they write to the company's data protection officer.

Chan's party, the New Century Forum, takes the position that the Octopus Company should be required to disclose the way it handles personal information, notwithstanding that Octopus is a privately held company. The majority of the company's shares are held by the Mass Transit Railway Corporation.

The Federation of Trade Unions filed a complaint against the Octopus Card claiming it breached the privacy of personal data when it disclosed to police information that led to the arrest of the suspect in the Causeway Bay acid-throwing attack in January.

Union member Dennis Leung said the federation is concerned that information could be leaked to third parties, leading to unfair commercial activities against the best interests of customers.

In a telephone survey of 1,004 people conducted earlier this month by the New Century Forum, less than 10 percent were aware of the card's personal data policy.

About 80 percent considered it unacceptable that their transaction records could expose them to direct marketing.

Party Board Member and Yau Tsim Mong District Councilor Chan Wai-keung said the survey was initiated after the complaint by the elderly minibus passenger.

Chan also called on the Privacy Commissioner for Personal Data (PCPD) to ask the company to disclose its usage of personal data. The party notes plans by OctopusCard to expand to Shenzhen, and to bid on 10 municipal government contracts to produce a citizen card that would serve as a means of identification, of data storage and a record of payments. That project would be undertaken by way of a joint HK$136.5 million venture with Digital China.

A spokeswoman for the PCPD said it could not comment on individual cases or companies, but Privacy Commissioner Roderick Woo Bun had said earlier his office would look into the card system concerning potential privacy issues - especially with personalized cards.

The Party also lashed out at the six-hour waiting time required to cancel a lost Octopus Card.

A spokesman for Octopus Card Limited said, "It also takes time to send files separately to all front-line processors to stop the use of the lost Octopus. (Customers) and Personalized Octopus users therefore need to bear the liability of any usage and add-value transactions within six hours after successfully reporting the loss of their Octopus.

China Daily

(HK Edition 06/29/2010 page1)