Lawmakers protest outside the Octopus Holding's IFC Two office building Friday when the board meeting of Mass Transit Railway Corporation (MTRC) was ongoing. They called for the entry of new players into the city's stored value card market if Octopus and the MTRC did not make a full disclosure of its business dealings regarding personal data. Edmond Tang / China Daily

Octopus Reward should erase its customer database: Privacy commissioner

Privacy Commissioner Roderick Woo Bun, in a preliminary report, has called on Octopus Rewards Limited to delete its customer database and start again with a more transparent approach in the wake of a public outcry over misuse of cardholder data.

Octopus Holdings Limited and its subsidiaries including Octopus Rewards have been the target of public ire over the collection and sale of the personal data of some 2 million users. The data was sold to so-called merchant partners for direct marketing or was outsourced to telemarketers.

Commissioner Woo released his preliminary findings Friday in his inquiry to determine whether the company had breached the city's privacy laws. Erasure of the customer database was one of a dozen recommendations Woo presented to improve the transparency of the card's Rewards program. Woo said a range of measures was needed to ensure that customers gave informed consent to becoming targets of direct marketers. "I would like the data subjects to be informed of the sale so that they can decide whether to give or to withhold their personal data to (Octopus)," Woo said. He added, registration forms should clearly state that only the customer's name and card number are needed to entitle the user to basic benefits and that there should be an opt-in choice for direct marketing, as opposed to the present automatic opt-in. Optional fields should be clearly denoted, while the types of companies that would have access to data should be stated. Another recommendation called for Octopus to present its terms of use in legible font so that they may be read without use of special aids.

The report also slammed the company's practice of permitting telemarketers working for merchant partners to represent themselves as employees of Octopus Rewards. The commissioner reiterated his call for a new law governing Octopus given that the company is a defector monopoly operating an essential public service.

In response to the public outcry, the company has halted its direct marketing partnerships. Woo added Octopus should do a better job of vetting merchant partners to ensure personal data security. Essential customer data should never be shared, he said.

A survey conducted by New Century Forum, the political party that sparked public date into the company's practices, found that 86.2 percent of those who responded to the survey described themselves as "angry" or "very angry" at the practices of Octopus Cards Holdings.

New Century Forum conducted the telephone survey among 775 Hong Kong residents between July 27 and 29, following public disclosure of Octopus Cards sale of private personal data. Of the households called, 81.3 percent agreed to take part in the survey.

In another sign of public distrust of Octopus Cards, 65.7 percent of respondents said they believed that the recent disclosures likely represented only a small part of the company's misuse of data. Only 2.7 percent of those who took part in the survey said they believe Octopus had made full disclosure.

74.3 percent of respondents urged a thorough investigation into the issue to be conducted under the Legislative Council Power and Privileges Ordinance. Only 4.6 percent disagreed.

60.1 percent of respondents agree that Chief Executive Officer of Octopus Holdings Limited Prudence Chan should resign for lying about personal data sales. Only 6.1 percent of respondents said they did not think she should step down.

Almost half (49.5 percent) of respondents said the SAR government is directly responsible for this issue since it failed to monitor the company. Another 41 per cent said they believed the government to be indirectly responsible for the affair.

China Daily

(HK Edition 07/31/2010 page1)