Privacy Commissioner initiates investigation on the Octopus 

1.    In view of the recent widespread public concern that the use of customers’ personal data for direct marketing in the “Octopus Rewards” program may contravene the requirements of the Personal Data (Privacy) Ordinance (“the Ordinance”), the Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Roderick B. Woo today (21 July) decided to initiate a formal investigation on the Octopus Holdings Limited (“the Octopus”) and the Octopus Rewards Limited, which is responsible for the “Octopus Rewards” program, pursuant to section 38(b) of the Ordinance.

2.    Major aspects of the investigation include:

i.    whether the Octopus’s collection of personal data of the data subjects is adequate but not excessive;
ii.    whether the means of collection are lawful and fair;
iii.    whether the transfer of personal data of the data subjects is consistent with or directly related to the original purpose of collection;
iv.    whether the data subjects are clearly informed of the purpose of collection and the use of the data;
v.    whether there is excessive disclosure of personal data when the data are passed to a third party for direct marketing.

3.    The Commissioner will start the hearings and summon witnesses to assist in the investigation next week.




END