completed investigation on Octopus Holdings Ltd
1. Pursuant to section 38(b) of the Personal Data
(Privacy) Ordinance ("the Ordinance"), the Privacy Commissioner for
Personal Data ("the Commissioner") Mr. Allan Chiang has completed the
investigations regarding the collection and use of customers’ personal
data under the Octopus Rewards Programme run by Octopus Rewards Limited
("ORL"), a company wholly owned by Octopus Holdings Limited
("OHL"). The investigations aimed to ascertain whether, in the
process of collection of customers' personal data and use (which
includes transfer) of the data for direct marketing purposes, there had
been contraventions of the requirement under the Ordinance, including
but not limited to Data Protection Principle ("DPP") 1 and 3 in
Schedule 1 to the Ordinance and section 34 of the Ordinance.
2. The Commissioner had sent the investigation report
to OHL and ORL on 30 September 2010.
3. As the matter has aroused widespread public
concern and in the interest of the public, the Commissioner intends to
publish the report. Unlike the interim report which was issued by
the Commissioner on 30 July 2010 to keep the public informed of the
progress of the investigations, the present report is final and will be
published under section 48(2) of the Ordinance. Hence, in
accordance with section 46(4)(b) of the Ordinance, the Commissioner has
to allow not less than 28 days for OHL and ORL to advise on the
following matters: (i) whether the disclosure of the report would
involve the disclosure of personal data that are exempt from the
provisions of DPP6 by virtue of an exemption under Part VIII of the
Ordinance, and (ii) if OHL and ORL object to the disclosure.
4. The Commissioner hopes that OHL and ORL could
respond to the above matters as soon as possible so that he could
publish the report at an early date.