Privacy Investigation Targets HK Card Firm

In Hong Kong, smart card payment systems provider Octopus Cards stands accused of breaching the privacy of millions of its customers. The charges include sale of personal data without permission to research companies including Asia Pacific agency Cimigo.

Octopus CEO Prudence Chan Pik-wah is accused of lying about the company's handling of customers' personal data, specifically its sale to a number of merchant partners.

While Octopus' major stakeholder MTR Corporation is discussing the possibility of taking Octopus' management under more direct control, the government, in the form of The Hong Kong Monetary Authority, has toughened its line and commissioned Deloitte Touche Tohmatsu to conduct an independent auditors' report on the company. The report is charged with establishing 'whether any third parties, including any related companies of OCL, had access to or received from OCL any Octopus cardholders' personal data, and if so, whether the use of such personal data was in accordance with the applicable laws, codes and regulations.'

Key among the accusers is the territory's Confederation of Trade Unions, which claims to have received testimony from a former employee of Cimigo who between 2006 and 2009 handled 'at least one million questionnaires' sent to Octopus cardholders via e-mail, with the resulting data sent to Cimigo without clients' consent. The Confederation's general secretary, legislator Lee Cheuk-yan, said Octopus' profit-making was 'unethical' and called for the criminalisation of such actions. Cimigo has issued a statement saying all its MR activities are compliant with international standards and that clients participated in the survey voluntarily. According to www.thestandard.com.hk , Octopus says that in addition to Cimigo it supplied personal data to five other merchant partners, including TNS.

Web sites: www.octopuscards.com/enindex.jsp and www.cimigo.com .