1. The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Allan Chiang notes the Report on Further Public Discussions on Review of the Personal Data (Privacy) Ordinance (“FPD Report”) issued today (18 April) by the Secretary for Constitutional & Mainland Affairs.
2. Mr. Chiang said, “I am glad that the Administration reaffirms that it would pursue the majority of the proposals previously made by my Office to provide greater protection to personal data privacy and enhance the effectiveness and efficiency of the operations of the Office of the Privacy Commissioner for Personal Data (“PCPD”). I look forward to an early implementation of the proposals.”
3. “However, I am disappointed with the Administration’s stance which differs from that of PCPD on some proposals which will have significant impact on personal data privacy. In these areas, PCPD maintains its stance, as made clear in its previous submissions. In particular, PCPD comments as follows.” said Mr. Chiang.
(a) Unauthorized Sale of Personal Data by Data User
The Administration proposes an opt-out approach to the sale of personal data. If a data subject does not respond to the data user’s notification of sale of the data within 30 days, the data user may deem that the data subject has not opted out of the sale activities.
Such deeming effect would in effect legalize the sale of personal data by data users that they are not otherwise permitted to engage in under the current Personal Data (Privacy) Ordinance (“PD(P)O”). The Commissioner considers that an opt-out approach is out of keeping with the strong public distaste expressed after the Octopus incident against the sale of personal data without the data subjects’ consent.
(b) Do-Not-Call Register
The Administration does not propose to set up a “Do-Not-Call” register on person-to-person telemarketing calls under the Personal Data (Privacy) Ordinance(“PD(P)O”).
The Commissioner acknowledges that regulating person-to-person telemarketing calls through the “Do-Not-Call” register may be more satisfactorily implemented under the Unsolicited Electronic Messages Ordinance (“UEMO”), which falls under the purview of the Commerce and Economic Development Bureau. As there was significant public support for this proposal in the two public surveys conducted by the PCPD in December 2010, he hopes that the Administration will continue to promptly and seriously consider the proposal under UEMO.
(c) Strengthen the enforcement powers of the PCPD
The Administration has decided not to confer the following power to the PCPD:-
(i) conduct criminal investigation and prosecution;
(ii) award compensation to aggrieved data subjects; and
(iii) impose monetary penalty for serious contravention of Data Protection Principles
The Commissioner is disappointed to note the Administration’s decision, which does not appear to be in accord with rising public expectation to strengthen the sanctioning powers of the PCPD and to deter privacy contraventions more vigorously.
4. The Commissioner will continue studying the FPD Report in detail and submit his views to the Administration and the Legislative Council for further consideration.