Lawmakers grill official for earlier statement over data disclosure

Octopus Cards Limited Chief Executive Officer Prudence Chan, facing an outcry calling for her resignation, says she has no intention of stepping down in the face of her misleading statements to the public and to the Legislative Council (LegCo).

Chan's statements were in regard to the company's sale of card users' personal data for profit. Chan denies that she had lied, going only so far as to say, "We admit we haven't done well. We are working hard to verify information," Chan said, adding, "Two weeks ago, our statement was different from the truth and I apologize to the public."

Chan only two weeks ago denied that the company sold private personal data of nearly two million card holders to companies engaged in direct marketing. Then Monday Chan contradicted her testimony before the Legislative Council Financial Affairs Panel weeks ago. She admitted while testifying at a public hearing of the Privacy Commission that Octopus had earned HK$44 million over the past four and half years selling data. She explained the discrepancies in her statements by saying she had been misinformed.

Calling for Chan's resignation as the only means to salvage the company's credibility, Democratic Party lawmaker Lee Wing-tat said, "In the past month you have repeatedly released not only misleading information but inaccurate information as well, and it is shown you have lied."

Chan countered that her earlier denial was based on a narrow definition of the word "sale." She said, at the time she was denying that her company had sold data for the "indiscriminate direct marketing to cardholders," adding the company exercised due diligence when selecting whom to sell to.

Industrial sector lawmaker Lam Tai-fai said, "If there is an integrity problem and lies are told, shouldn't (Chan) be held responsible and be sacked?"

Lee also hit out at the Hong Kong Monetary Authority (HKMA), which is empowered to supervise the operations of Octopus Cards Limited, saying it had not conducted any investigations despite its huge pool of manpower compared with the Privacy Commission which had already launched its own investigation and had held a public hearing.

Executive Director of the HKMA's Banking Supervision Department Nelson Man said the authority was preoccupied thwarting hacking threats but will divert resources.

Unionist legislator Wong Kwok-hing let stand his threat to call for a LegCo vote to invoke the Council's Powers and Privileges Ordinance this October, which would force total disclosure by Octopus as to how it handled personal data, unless the company agrees to cooperate with the council. The LegCo would require that within two weeks, Octopus Holdings disclose details on how much data was sold, to whom and for how much, in addition to details of contract agreements and other operations by Octopus Holding Company's subsidiaries.

Lawmakers also lambasted the HKMA and Mass Transit Railway Corporation (MTRC) for not sending senior officials to attend the panel meeting. Some angry lawmakers called for the HK$44 million earned through the sales of personal data to be refunded to cardholders and for MTRC to be held equally liable.

MTRC Legal Director and Secretary Leonard Turk said although the MTRC was the biggest shareholder of Octopus, it was not in control. The companies have separate management and function independently. He also pointed out that Octopus deals with MTRC's competitors.

The only lawmaker to spare the rod was insurance sector legislator Chan Kin-por, who described the practice of using personal data to promote products as normal commercial activity worldwide.

Four reports are expected over the handling of personal data by Octopus, including a Privacy Commission rough report to be ready by the weekend, an HKMA report by an external auditor due in 10 weeks, a LegCo report due in two weeks and an internal review by a special committee of non-executive directors of Octopus Holdings.

Octopus had come under scrutiny over the vagueness of its terms of usage for handling personal data as set out in its privacy agreement and because it holds a de-facto monopoly on the city's smart card payment system.

The company had been selling to at least six other companies personal data of Octopus users who subscribed to its Rewards, personalized and automatic upgrade services.

Data had been sent to two insurance companies, one of which, CIGNA Hong Kong, subcontracted operators to the card company who were instructed to say they worked for Octopus, while the other company, CPP Hong Kong Limited, outsourced its telemarketing operations.

A caller to a local radio program surnamed "Kwong" alleged Octopus had also sold or transferred his transaction history to a third party, saying a telemarketer revealed the company knew his average monthly spending at a certain department store through his subscription to the Octopus Rewards program.

China Daily

(HK Edition 07/28/2010 page1)