The Privacy Commissioner for Personal Data ("the Commissioner") Mr. Allan Chiang briefed today (15 March) the major work accomplished by the Office of the Privacy Commissioner for Personal Data ("PCPD") in 2010 as follows:

1.    Complaint Cases

From January to December 2010, 1,179 complaint cases were received, an increase of about 18% over the same period last year.  In these complaints, 912 cases were against private sector, 160 against public sector and 107 against individuals.  Regarding complaints against private sector, financial institutions received the highest number of complaints (226 cases), followed by telecommunications (116 cases), property management (99 cases), insurance (46 cases) and educational service (35 cases).

With regard to the nature of complaints, the highest number of complaints was related to the use of personal data without the consent of data subjects (522 cases), while complaints about collection of data & purpose (480 cases) and about use of personal data in direct marketing (157 cases) ranked the second and the third places respectively.  Complaints about use of personal data in direct marketing soared 130% over the same period last year (68 cases).

In 2010, the Commissioner issued a total of 10 enforcement notices, directing the data users concerned to take specified steps to remedy the contraventions.  Moreover, the Commissioner also issued warning letters and provided advice or recommendations to data users complained in 215 cases.

Moreover, according to section 48(2) of the Ordinance, the Commissioner may, after completing an investigation and if he is of the opinion that it is in the public interest to do so, publish a report.  To exercise this power and in the public interest, the Commissioner published five investigation reports in 2010.

2.    Conviction Cases

In the year, 12 contravention cases were referred to the Police for consideration of prosecution.  Of these, a telemarketing company was convicted of contravening sections 34(1) and 64(10) of the Ordinance and was fined $5,000 in February 2011; 7 cases were not prosecuted, and the remaining 4 cases are being followed up.

In the above conviction case, the complainant had requested the telemarketing company not to contact him for the purpose of direct marketing.  However, the telemarketing company continued to contact him despite his opt-out request.  Under section 34(1), a data user should stop contacting the individual who has made an opt-out request.

3.    Enquiry Cases and Compliance Checks

In 2010, the PCPD received a total of 18,000 enquiry cases, as compared with 18,760 cases in 2009.  Major issues of enquiries involved human resource and personal data, data access requests, collection of ID card numbers or copies, and use of personal data in direct marketing.

On the other hand, where the Commissioner finds that a practice may be a contravention of the requirements under the Ordinance that may adversely affect the data privacy of individuals, he may on his own initiative undertake compliance checks and request the data user to take appropriate remedial actions.  In 2010, 127 compliance checks were carried out to review the practices of data users alleged of contravening the Ordinance, representing an increase of about 19% over the same period in 2009 when 107 compliance checks were carried out.


4.    Conclusion

Hong Kong people learnt an important lesson on the protection of personal data privacy when the incident of misuse of personal data of members of the Octopus Rewards Programme run by Octopus Rewards Limited (“ORL”) was exposed.  As personal data of over two million people were involved, extensive public concern ensued.  The PCPD immediately commenced an investigation and carried out a public hearing.  In the course of the investigation, ORL was found to have made monetary gain in transferring the customers’ data to third parties, thus contravening the Data Protection Principles.  The incident had aroused people’s awareness that their personal data might be used by others for profit making.  It also highlighted the wrongful approach many data users had adopted in the collection and use of personal data.  The issues raised had been taken into account by the Government during the review of the Personal Data (Privacy) Ordinance.

The Commissioner is pleased to note that the Octopus incident has brought community awareness and understanding of the importance of personal data protection to an unprecedentedly high level.  It has also served as a wake up call to many organizations as data-users.  They are now more sensitive to personal data protection and a lot of them have actually reviewed their operational policies and procedures, including the Personal Information Collection Statement to ensure compliance with the requirements under the Ordinance.

The PCPD hopes that data users will pay due respect to personal data privacy and the general public will be more careful in protecting their personal data.  To this end, the PCPD will step up its efforts in enforcement as well as business and public education.

5.    Highlights of the 2011 Work Plan

Enforcement
The Commissioner awaits the outcome of the Administration's review of the Ordinance.  He trusts that the amendments to the Ordinance will enhance the control and increase the penalties to bring about a greater deterrent effect in promoting compliance with the requirements under the Ordinance.

Meanwhile, in an effort to enhance the effectiveness of prosecution for cases of contraventions, the Commissioner had a meeting with the Police and the Department of Justice yesterday (14 March) to discuss the formulation of policies and guidelines for the investigation and prosecution of referred contravention cases under the Ordinance.

Mr. Chiang said, "The meeting noted that the success rate of prosecution in the past was low.  From January 1998 to December 2010, PCPD has referred 74 cases to the Police.  Of the 56 cases that were related to offences under the Ordinance, only 13 cases ended up being heard in the courts with nine convictions and four acquittals. The meeting was fruitful and constructive.  The two departments shared their experience of unsuccessful prosecution of contravention cases with the PCPD.  This beneficial meeting may help enhance the future prosecution rate.  Moreover, the two departments will shortly conduct seminars for PCPD’s investigation officers to enhance their investigation skills.  In the long run, the PCPD will continue the dialogue with the two departments to enhance the successful rate in the prosecution of contravention cases."

Promotion and Education Work

The PCPD has been making efforts to provide the community with educational activities.  Regarding the introduction of personal data protection, the PCPD organizes regular free introductory seminars on the Ordinance for the public.  Due to overwhelming responses, the frequency of the seminar has been increased from once per month to three times per month since February 2011.

Moreover, the PCPD organized public seminars on topical issues.  Starting from March, seminars on “Protection of Personal Data Privacy - Proper Use of Technology in Daily Life” have been conducted once every month to provide education on the protection of personal data privacy in the use of Internet and advanced communications products.

On the other hand, the PCPD will launch 17 professional compliance workshops from April to June 2011.  The workshops are tailored to meet the needs of executives dealing with personal data in different work contexts.  The courses are suitable for data protection officers, human resource managers, solicitors, compliance officers, IT managers and company secretaries.  In promoting the Workshops, the PCPD has solicited the support of 23 professional organizations and trade associations.  This reflects that data protection has become a vital component to the success of business in building employee trust and customer loyalty as well as enhancing corporate image. 

The PCPD will also make new attempts to convey the message of personal data privacy to the younger generation through Liberal Studies and Other Learning Experience (“OLE”) under the New Senior Secondary curriculum. It plans to produce a set of teaching materials, which includes basic knowledge about the Ordinance and work sheets on topical privacy issues, to enable students to analyze the importance of personal data privacy vis-à-vis other interests in the community.  PCPD staff will act as privacy mentors and assist secondary students to organize their own Privacy Awareness promotional activities within their schools under the OLE through seminars and workshops.  At present, over 700 students from 31 secondary schools have enrolled as the student ambassadors of “School Privacy Awareness Activities”.