Biz News Flash

Octopus scandal to prompt stiffer legislation

By Guo Jiaxue (HK Edition)
Updated: 2010-10-19 07:01

The government on Monday proposed to criminalize unauthorized collection and use of personal data and to impose stiff penalties for those who violate the privacy rights of Hong Kong citizens.

The declaration came within hours of the statement from the Office of the Privacy Commissioner for Personal Data, which ruled that Octopus Rewards Limited contravened three Data Protection Principles but will escape punishment.

A total of 37 proposals are set out in the newly published report following public consultation to review the Personal Data (Privacy) Ordinance. A new round of public discussion was launched particularly because of legislative proposals to strengthen personal data privacy protection under the Ordinance.

Stephen Lam, secretary for Constitutional and Mainland Affairs, stressed that any personal data collection or use of it for direct marketing, transactions, or sales purposes must be authorized, otherwise the purveyors of personal data may face prosecution.

It's proposed to make it an offense for anyone to sell personal data without the person's consent. Under present statute, the Octopus scandal can be ruled only a contravention of the Data Protection Principles.

Compared with the current provisions under which contraventions of Data Protection Principles are not offenses, the government proposes to make it a criminal offense if a gatherer of data fails to comply with the requirements concerning the collection and uses of client data for direct marketing purposes.

The government also proposes to introduce additional, specific requirements concerning the use of personal data for direct marketing, including requiring that the Personal Information Collection Statement of the data collector be reasonably specific about the intended marketing activities, the classes of persons to whom the data may be transferred, and the kinds of data to be transferred. The presentation of the statement should be understandable and reasonably readable by the general public. And the owner of the data should be provided with the opportunity to choose.

The government also proposed to make it an offense for a third party to disclose personal data for profit or for malicious purposes without a data user's consent.

The punishment for contraventions is expected to be severe. The penalty for using personal data without the consent of the owner is proposed to be set at three-years with an accompanying fine of up to HK$50,000.

An even heavier penalty is proposed for repeat offenders, with a maximum fine of HK$100,000 and two years' imprisonment.

The government also suggested a change of powers of the Privacy Commissioner for Personal Data. The Commissioner is proposed to be given the power to provide legal assistance, to help an aggrieved data subject to institute legal proceedings and seek compensation.

Lam said the government will study the granting of additional powers to the Pricacy Commissioner. He stressed that at present only the police and the Department of Justice are entitled to investigate and prosecute.

Lam expressed confidence that the amended ordinance will have greater deterrent power.

Gene Rait, chairman of Hong Kong Direct Marketing Association, however voiced his concern, "Despite all our efforts, the customers rarely read the materials. That's a sad fact."

Lam said a bill to amend the ordinance will be tabled at the Legislative Council (LegCo) by the end of the legislative year. The new round of public consultation will conclude by the end of this year (before the bill will be tabled at the LegCo by the next summer).