Privacy and Data Protection

Implications of the Personal Data (Privacy) Ordinance to the business community

Protecting individual privacy and keeping the free flow of information are both vital for a modern economy like Hong Kong. "The Personal Data (Privacy) Ordinance has crucial implications for many business sectors, thus we should have greater awareness and better understanding on it to ensure the data-protection regime in Hong Kong is both user-friendly and effective in protecting personal privacy." remarked Mr Henry Goldstein, Chairman of the HKCSI Information Services Committee said at the HKCSI seminar on Privacy and Data Protection on 7 October.

Stephen Lau, Privacy Commissioner for Personal Data, told the 110 participants that opinion polls in industrialised countries had revealed a growing concern for individual privacy. To date around 30 jurisdictions have enacted laws to protect privacy with respect to personal data. A survey conducted by the Social Science Research Centre of Hong Kong University in 1993 found that a quarter of those polled considered privacy to be a very important issue. 85% and 94% felt they should have respectively rights of access and correction when a loan was refused. 63% said they should have the right to stop direct mail.

Transborder Data Flow (TDF)

According to Mr Lau, apart from the protection of privacy, another impetus towards the proliferation of legislative measures was the issue of transborder data flow. For example, TDF of personal data was generated where flight reservations were made in another country or when foreign tourists use credit cards. While a passenger would not oppose to the transfer of data to another country to facilitate the flight, privacy issues arouse if the data were used for other purposes, such as marketing of other products to the passenger. "The dilemma arising from this ever increasing flow of personal data between countries derives from their greatly variable levels of privacy protection," he added.

Basing on OECD guidelines, the Data Protection Principles and Guidelines for Hong Kong was promulgated in 1988 and the Ordinance was signed into law in August 1995. "The purpose of the Ordinance is to protect the privacy interests of living individuals in relation to personal data. It also contributes to Hong Kong's continued economic well being by safeguarding the free flow of personal data to Hong Kong from restrictions by countries that already have data protection laws."

"Privacy is not just a moral or social issue, it is also an emerging business imperative. It makes sense for business to tackle this issue proactively, to gain market differentiation and competitive advantage through enlightened approaches to the privacy of their customers and employees. This may be a key factor for business successes in the 90's and beyond." said Mr Lau.

Ms Susie Cheung, a solicitor, advised on the compliance of the Personal Data (Privacy) Ordinance. She alerted the audience of the specific exemptions from the requirements of the Ordinance and drew their attention to the six data protection principles set out in the Ordinance.

Godfrey Rooke, chairman of Hong Kong Direct Marketing Association, told participants the potential implications of the Ordinance for marketing databases. He said the purpose of direct marketing is to isolate those individuals interested in receiving messages and communicating with the marketer. This enables the building up of a continuing relationship beneficial to both parties. He gave an analysis of the role of database in the direct marketing process. Individuals can complain to the Privacy Commissioner for Personal Data on suspected breaches of the Ordinance and claim compensation for damage through civil proceedings.

Mr Rooke recommended that "when collecting data from an individual for the first time, the data subject must be given the opportunity to opt out of receiving promotional or marketing contact from the advertiser/marketer and/or third parties." If the first-time element is not practical, all response devices or application forms should contain a choice offering "opt out".

¡@