1. Pursuant to section 38(b) of the Personal Data (Privacy) Ordinance ("the Ordinance"), the Privacy Commissioner for Personal Data ("the Commissioner") Mr. Allan Chiang has completed the investigations regarding the collection and use of customers’ personal data under the Octopus Rewards Programme run by Octopus Rewards Limited ("ORL"), a company wholly owned by Octopus Holdings Limited ("OHL"). The investigations aimed to ascertain whether, in the process of collection of customers' personal data and use (which includes transfer) of the data for direct marketing purposes, there had been contraventions of the requirement under the Ordinance, including but not limited to Data Protection Principle ("DPP") 1 and 3 in Schedule 1 to the Ordinance and section 34 of the Ordinance.
2. The Commissioner had sent the investigation report to OHL and ORL on 30 September 2010.
3. As the matter has aroused widespread public concern and in the interest of the public, the Commissioner intends to publish the report. Unlike the interim report which was issued by the Commissioner on 30 July 2010 to keep the public informed of the progress of the investigations, the present report is final and will be published under section 48(2) of the Ordinance. Hence, in accordance with section 46(4)(b) of the Ordinance, the Commissioner has to allow not less than 28 days for OHL and ORL to advise on the following matters: (i) whether the disclosure of the report would involve the disclosure of personal data that are exempt from the provisions of DPP6 by virtue of an exemption under Part VIII of the Ordinance, and (ii) if OHL and ORL object to the disclosure.
4. The Commissioner hopes that OHL and ORL could respond to the above matters as soon as possible so that he could publish the report at an early date.