Protecting consumer privacy


Consumer information is a valuable commodity as it can be used to analyse personal profiles and behavioural patterns. In turn, it enables businesses to predict and monitor market performance and trends.

In response to ongoing concerns regarding data privacy at both international and domestic levels, data protection issues remain in the spotlight in Hong Kong. During an International Telecommunications Union (ITU) workshop on Ubiquitous Network Societies in Geneva, Switzerland, Mr Tony Lam, Hong Kong’s acting Privacy Commissioner, reiterated the need for improved consumer privacy protection in Hong Kong in light of recent technological advancements.

The multi-jurisdictional transfer of data has become an inseparable part of the global economy and the mechanisms governing the practice have aroused much attention. The Organisation for Economic Co-operation and Development (OECD) was first to acknowledge the importance of data protection as it was amongst the first to establish a set of guidelines relating to the protection of privacy.

Since this initial guidance, continuous reviews have been conducted as the advent of technology has made it easier to access, collect and store all kinds of information.

Ubiquitous technologies such as wireless communications and radio frequency identification devices (‘RFID’) enable information to be transferred at high speed without inconveniencing the information provider. Sometimes these processes lead to the collection and storage of information without the knowledge of the consumer.

An increasing reliance on the internet and related technologies by industries and governmental authorities has posed an even greater risk to privacy as personal data can be exposed to unintended, unauthorised and/or fraudulent uses.

Many privacy concerns relate to online transactions. This is because problems arise predominantly when consumers are required to provide personal information such as their name, address and credit card information.

In his recent speech, Mr Lam indicated that in Hong Kong in 2004, consumers placed privacy protection ahead of quality of service, range of choice and pricing when evaluating the importance of factors that would affect a decision to purchase online.

Mr Lam’s findings suggest that although it has been nine years since the enactment of the Personal Data (Privacy) Ordinance (‘PDPO’) (Cap. 486), there is much that can still be done to enhance consumer confidence. Mr Lam advised that it is crucial for businesses to ensure that their practices are in compliance with the PDPO in order for the PDPO to be effective.

The PDPO was enacted in response to the general recognition of a need to protect privacy of personal data through statutory means. The PDPO serves several functions, the most important functions include:

  • giving effect to internationally accepted data protection principles
  • providing for the appointment of an independent statutory authority, the Privacy Commissioner for Personal Data, to monitor, enforce and promote compliance with the PDPO
  • imposing conditions on the use of personal data in automated machine processes
  • imposing conditions on transfer of personal data originating from Hong Kong to places outside of Hong Kong
  • setting out the enforcement regime for a variety of offences

Many large-scale corporations in Hong Kong have already implemented electronic privacy policies within their respective corporate frameworks. Compliance is viewed as a good business incentive as consumers become more knowledgeable and concerned about their own privacy.

In tandem with this, businesses are conducting Privacy Impact Assessments to evaluate the effect of proposed projects in the light of privacy concerns. By assuring consumers that their information is being adequately safeguarded, businesses are able to build trust and confidence between themselves and their customers. It is hoped that this accumulated trust and confidence will enhance their corporate reputations and consumer loyalty thus allowing them to gain a competitive edge.

Mr Lam indicated that the effectiveness of such policies is perceived to be vital as over 80% of the organisations surveyed had agreed that compliance with the PDPO brought and will continue to bring long-term benefits to their business in terms of their public image, data management and customer relations. More importantly, Mr Lam indicated that recent surveys demonstrate that compliance with the PDPO does not restrict business activities; rather it boosts corporate governance practices, which reinforce the economy as a whole.