Hong Kong is a world class city of business and it should pride itself on offering the world a leading standard in business practices - and not in the lax manner that arises from poor regulation and business ethics that allow business companies to seize on means to maximize profit at the expense of their customers. The recent financial tsunami exposed the regulatory weakness of the local financial system. The recent controversy around Octopus, the local electronic money monopoly, might be another indication that the local regulatory system must be strengthened to protect the interests of local users of financial services. It also demonstrates that quite a number of local corporate CEOs should be reeducated in business ethnics and respect for personal privacy.

Amid the Octopus controversy, the company's CEO Prudence Chan started by denying that clients' personal data was sold to third parties for direct marketing. When local legislators questioned her further, she said her earlier denial was erroneous because she did not have critical information when she issued her first denial. She later revealed that the selling of personal data had involved 1.97 million clients over a period of over four and half years, earning a profit of HK$44 million for the company. As CEO of the company and the person who might well initiate such deals, Chan should have had full knowledge of the business. Through her public denial when confronted by the media and legislators who pressed serious concerns on behalf of the public, she has shown the ugliest side of corporate management, namely, a lack of honesty, lack of business ethics, and lack of social responsibility. Business educators at local universities teaching aspiring corporate executives ought to use her case as an example of poor business ethics; and of what the local corporate community should avoid if Hong Kong is going to continue to be a world city of business.

So far the public is still skeptical about the 'truth' revealed by Ms Chan. Questions remain as to whether the information so far disclosed is only the tip of the iceberg concerning the misuse of clients' personal data for the company's profit. Was the management of the company, including the board of directors, fully aware of the unethical nature of the practice or were they misled by the CEO and her staff? The Privacy Commissioner is yet to report on the incident, and probably even if the finding shows the company did not violate the current privacy law of Hong Kong, legislators should revise the law to increase protection of the privacy of Hong Kong citizens. Legislators also should provide for penalties to deter purposeful violation of privacy by businesses and government organizations. The majority shareholder of Octopus is MTR whose own majority shareholder is the Hong Kong SAR Government. Octopus should be regarded as a public corporation (not just because it is publicly listed) and as such, the SAR Government should not, and cannot, escape from responsibility concerning supervision and monitoring of business ethics of the company.

More significantly, the company has a market monopoly over electronic money in Hong Kong. The system handles an average of 11 million financial transactions per day and affects many aspects of the daily life and work of Hong Kong citizens and firms. It should not be left to the discretion of management, who might lack commitment to business ethics and respect for legal regulations despite their high salaries and impressive educational qualifications. Octopus should be tightly supervised and monitored like the big banks in Hong Kong. Given the present trend of market and technology development, electronic money and the electronic payment system has a great prospect of exponential expansion over the coming years. The monopoly of Octopus will not be on a small scale nor will Octopus be one of the many ordinary deposit-taking institutions that are presently registered as being under the Hong Kong Monetary Authority. The government and the public need to have tight control to avoid not just the misuse of personal data of a huge number of local citizens but also the potential danger that the management might create financial risks to the company and the local community resulting from its blind pursuit of maximized profits.

Local privacy law needs to be revised and regulatory control over Octopus should be strengthened. At the same time, local legislators together with the privacy commission should find out the complete truth concerning the sale of the personal data of Octopus clients and whether there have been violations of existing privacy law. The majority owner of the company should also act in good faith: apologizing to the public by returning the 44 million dollar profits (plus an amount paid in penalty ) either to the Octopus card holders or to local charity

The author is head of the China Business Centre, Hong Kong Polytechnic University.

(HK Edition 07/30/2010 page2)