I would like to respond to the recent media reports on the installation of pinhole cameras in Cheung Sha Wan Post Office in 2005 to identify the culprit of a series of theft cases which took place in that post office. Investigations by the then Privacy Commissioner for Personal Data (the “Commissioner”) concluded that the arrangement had contravened the Data Protection Principles under the Personal Data (Privacy) Ordinance (“Ordinance”). As I was the Postmaster General at that time, doubts were expressed in the media on whether this incident would jeopardise my credibility as the new Commissioner.

I wish to highlight the facts that the incident took place five years ago, was an isolated case involving one post office, and the arrangements were made on a regional level without my knowledge or authority. Despite the legitimate purpose to protect customers’ property from theft, and efforts were made to manage the personal data collected, the arrangement had not complied fully with the requirements of the Ordinance.

Some newspapers have also enquired about an allegation in 2005 that the Post Office had passed the personal data of some job applicants to recruitment contractors for processing without their knowledge. As the Post Office has responded, the complaint was unfounded. It had not passed personal data of job applicants to any company.

I hasten to add that as the head of the Post Office at the material time, I was accountable for the pinhole camera installation, albeit I was not the mastermind. However, I must emphasize that, on a personal level, there was no issue of my ignorance of personal data privacy rights. The pinhole cameras were dismantled as soon as I became aware of the installation. All Post Office staff had been briefed of the background of the incident. Systems for management of personal data have since been improved and measures to protect the privacy of personal data have been tightened up. 

I stress that I have the highest respect for the privacy of the individual with respect to personal data. The lessons I learnt from the Post Office incident underlined the importance of the mission of the Privacy Commissioner for Personal Data to secure the protection of personal data privacy through (i) promoting the awareness and understanding of privacy rights among data users, as well as (ii) taking regulatory action to uphold this basic human right.

I pledge to do my utmost to make a contribution in fulfilling the mission of the Privacy Commissioner for Personal Data.


END