Octopus Card admits huge customer data sale
Nearly two million cardholder details passed on
Octopus, the operator of Hong Kong’s transit and micropayments smart card system, has admitted selling the personal data of 1.97 million million cardholders to other businesses.
The company said it made US$5.7m over 4½ years by sharing the data with six companies for marketing purposes.
Octopus had previously denied selling the data and the news has brought demands for greater controls on the way companies handle customer details.
Hong Kong privacy legislation does not forbid sharing data with third-party companies, but Octopus will need to clarify that it gained proper consent from its clients to share their data, and whether more personal details were shared than necessary.
Octopus Card CEO Prudence Chan said that a lack of available information at the time had led to her erroneously denying data had been sold.
“We acknowledge that the situation hasn’t been handled well,” she told a hearing of the security panel of Hong Kong’s Legislative Council. “What we said [earlier] didn’t fully reflect the truth, and for that we apologize to the Hong Kong public.”
James To, the deputy chairman of the security panel,, said he expects his colleagues to consider invoking special powers to investigate Octopus Card as the full picture of what happened has not emerged yet.
He added a much clearer picture would emerge if the Legislative Council carries out an investigation, in tandem with three ongoing investigations that have been launched by the Privacy Commissioner, the Monetary Authority, and the company itself.
Octopus cardholders have been telling local media how they have been affected by the data sale, with one saying he received calls from an insurance company which was aware of how much he spent in a supermarket every month.
Hong Kong Privacy Commissioner for Personal Data Roderick Woo Bun says the data scandal is just the tip of the iceberg and that two banks have breached regulations on privacy by handing over custome’ information to third parties. He declined to name the banks as they have filed appeals.
Octopus cards are used by millions of Hong Kong residents for purchases such as transit tickets, fast-food meals and convenience store products.