Key Information

inSight
Speeches
Speeches by Speaker
Norman T.L. Chan
Peter Pang
Eddie Yue
Arthur Yuen
Zeti Akhtar Aziz
Raymond Li
Edmond Lau
Esmond Lee
Meena Datwani
Vincent W.S. Lee
James Lau
Joseph Yam
Y K Choi
William Ryback
David Carse
Tony Latter
Andrew Sheng
Hans Genberg
Simon Topping
Michael Taylor
The Honourable Donald Tsang
Chen Yuan
Dai Xianglong
Don Brash
Jaime Caruana
Andrew Crockett
Mario Draghi
David Eldon
Stanley Fischer
Timothy F. Geithner
Stephen Grenville
Kenneth G. Lay
William McDonough
Ernest Patrikis
Glenn Stevens
Jean-Claude Trichet
Tarisa Watanagase
Zeti Akhtar Aziz
Carmen Chu
Alan Au
Press Releases
2010
2009
2008
2007
2006
2005
2004
2003
2002
2001
2000
1999
1998
1997
Press Releases by Category
Bogus Voice Message Phone Calls
Banking in Hong Kong
Fraudulent Websites, E-mails and Telephone System, and other fraud cases
Granting of Banking Licences
Exchange Fund
Table of Multiples of Notes and Payments for Allotted Amount under non-competitive tender
Table of Multiples of Notes and Payments of Application Amount under non-competitive tender
Tender of Exchange Fund Bills and Notes
Tender Results of Exchange Fund Bills and Notes
Tentative Issuance Schedule for Exchange Fund Bills and Notes
Appointments and Departures
HKMA Pay Review
HKMA Publications
Speeches
The Hong Kong Mortgage Corporation
Hong Kong Note Printing Limited
Hong Kong Institute for Monetary Research
Exchange Fund Investment Limited
Others
Hong Kong Financial Infrastructure
International Relations
Investment Products Related to Lehman Brothers
Monetary Policy
Notes and Coins
Renminbi business
Credit Card Lending Survey
Monetary Statistics
Residential Mortgage Survey
Year 2000
Others
Guidelines and Circulars
Guidelines
Circulars
2015
2014
2013
2012
2011
2010
2009
2008
2007
2006
2005
2004
2003
2002
2001
2000
1999
1998
1997
515.5995

Press Releases

Independent auditors submit to the Monetary Authority
interim findings in the section 59(2) report on Octopus Cards Limited

The Hong Kong Monetary Authority (HKMA) announced today (Monday) that Deloitte Touche Tohmatsu (DTT), the independent auditors, have submitted to the Monetary Authority their interim findings in the report on Octopus Cards Limited (OCL) commissioned under section 59(2) of the Banking Ordinance (the "interim report").

The purpose of the section 59(2) report is to independently find out and assess OCL's processes and practices for the handling of Octopus cardholders' personal data in the light of the concern about the Rewards Program operated by Octopus Rewards Limited. The scope of the review includes, among other things, establishing which third parties had received from OCL Octopus cardholders' personal data and what personal data was passed to these third parties; establishing what policies and procedures were in place to govern the sharing of such personal data; establishing what due diligence OCL performed before sharing such personal data with third parties; and making recommendations to enhance the effectiveness of data privacy protection in OCL.

DTT found that a total of six entities had received Octopus cardholders' personal data from OCL and other members of the Octopus group for direct marketing activities. No transaction data of Octopus cardholders was transferred to these six entities. The names of these entities are the same as those made public by Octopus Holdings Limited on 29 July 2010.

DTT have also reviewed the documents, internal policies, procedures and guidelines on data security and privacy adopted by OCL, and confirmed that:

  • OCL Management sought in 2002 legal advice to ensure compliance with applicable laws and regulations including the Personal Data (Privacy) Ordinance (PDPO) before OCL first started sharing Octopus cardholders' personal data with third parties for marketing activities.
  • OCL Management informed its Board in 2002 about the development of business initiatives concerning the use of Octopus cardholders' personal data, and that legal advice had been taken to ensure that the program was in compliance with the PDPO.
  • OCL conducted periodic onsite compliance checks on business partners to assess their systems of control in relation to data security.
  • OCL conducted internal audits periodically covering, among other things, compliance with the PDPO.

DTT also noted a number of communications during the period from early 2004 to August 2010 between the Office of Privacy Commissioner for Personal Data (PCPD) and the Octopus group relating to the group's handling of personal data, covering among other things, how consent was obtained from cardholders, the arrangement for sharing personal data with unrelated third parties for direct marketing purpose and the types of personal data shared with these third parties, and the actions taken by the group in response to the PCPD's concerns raised in these communications.

Based on their findings, DTT have proposed a number of recommendations, among other things, to enhance OCL's systems of control in the collection, storage and retention of customers' personal data, and the due diligence and controls in the sharing of such data with third parties should OCL carry out similar business activities in the future.

The HKMA has published in full the interim report given the recent concern about the handling of Octopus cardholders' personal data (attached). The HKMA has also sent a copy of the interim report to the PCPD for reference and appropriate action. When the outcome of DTT's final report on OCL is available, the HKMA will consider the most appropriate follow-up action. Among other things, the HKMA will require OCL to implement the recommendations in the reports and will monitor its progress in liaison with the PCPD as appropriate. The HKMA also understands that the PCPD will shortly issue its final report on Octopus. Taking into account any new recommendations and guidelines on the collection and use of personal data, we will liaise with the banking industry to ensure that banks will follow the latest standards set by the PCPD.

DTT expect to complete the field work shortly and to submit a final report to the HKMA thereafter. The HKMA will set out the findings of the final report in an appropriate form for public information.

For media enquiries, please contact:
Anissa Wong, Manager (Communications), at 2878 1802 or
Natalie Wu, Officer (Communications), at 2878 8246

Hong Kong Monetary Authority
18 October 2010

Last revision date: 1 August 2011
ABOUT THE HKMA
The HKMA
Tender Invitations
Careers@HKMA
Legislative Council Issues
Links
The HKMA Information Centre
KEY FUNCTIONS
Monetary Stability
Banking Stability
International Financial Centre
Exchange Fund
PUBLICATIONS & RESEARCH
Annual Report
Half-Yearly Monetary & Financial Stability Report
Quarterly Bulletin
HKMA Background Briefs
Reference Materials
Research
MARKET DATA & STATISTICS
CMU Bond Price Bulletin
Economic & Financial Data for Hong Kong
Monthly Statistical Bulletin
Monetary Statistics
KEY INFORMATION
Press Releases
Speeches
Guidelines & Circulars
Forthcoming Events
inSight
OTHER INFORMATION
Information in Other Languages (Bahasa Indonesia, हिन्दी, नेपाली, ਪੰਜਾਬੀ, Tagalog, ไทย, اردو)
Account Opening
Consumer Corner
Consumer Education Programme
Complaints about Banks
Complaints about SVF Licensees
Internet Banking
Fraudulent Bank Websites, Phishing E-mails and Similar Scams
Be Careful of Bogus Phone Calls and SMS Messages
Authenticate the Callers and Bank Hotline Numbers
Register of AIs & LROs
Register of Securities Staff of AIs
Register of SVF Licensees
Investment Products Related to Lehman Brothers
Photo Gallery