Octopus Cards Limited - Controversy Over Use of Personal Data

Controversy Over Use of Personal Data

Octopus became the centre of a controversy in mid 2010, when some individuals complained that they had received unsolicited sales calls which they alleged came from business partners of Octopus. Octopus chief executive Prudence Chan initially denied that any personal data had been given over to third parties, but said that cardholders' consent to use their data would have been given when they registered for the Octopus reward program, which had an opt-out mechanism. The company came under fire for deception when a former worker at an insurance company said that Octopus had bought data on 2.4 million reward scheme cardholders. At a hearing before the Privacy Commission on 26 July 2010, it was subsequently revealed that it had entered into partnership agreements through which card-holders' personal details were sold to an insurance company and others for HK$44 million. The company disclosed that personal data collected from Octopus rewards program had been sold to six vendors since 2002, and that two such relationships were still current. The company was further criticised when it was revealed that there were no safeguards on the transfer or reuse of the personal data to parties outside of Hong Kong. Chan apologised before a Legislative Council's finance affairs panel meeting; she said that she 'might have used a wrong definition of selling at the time'. Legislators from all parties demanded Chan's resignation for attempting to mislead the public, thus precipitating a crisis of confidence in the company, and putting the company into disrepute by her lies.