1. Statement of policy
It is our policy to meet fully recognised standards of personal data privacy protection in complying with the applicable requirements of the Personal Data (Privacy) Ordinance (PDPO), and we strive to ensure compliance by our staff with the standards of security and confidentiality prescribed by law.
2. Statement of practice on personal data held by us
We may collect and hold personal data in performing our statutory functions under the relevant laws and regulations, in performing other functions and responsibilities falling within the remit of the HKMA as Hong Kong’s central banking institution and regulator, and as employer. This Statement and, where applicable, the relevant Personal Information Collection Statement (PICS) provided will state (among other matters) the purpose of collection of personal data.
The broad categories of personal data held by us, and the main purposes of use are:
(a) | authorization, licensing, approval and registration application records and related returns and notifications, and submissions in response to public consultation papers, used for processing the relevant applications, carrying out the consultation, displaying in the public registers and performing our statutory functions, responsibilities and administrative activities; |
(b) | enquiry, complaint, inspection, oversight, supervisory, investigation and enforcement records, used for responding to and handling enquiries and complaints, and performing our statutory functions, responsibilities and administrative activities; |
(c) | records collected in connection with, and used for the purposes of, the HKMA’s use and management of the Exchange Fund, the HKMA’s processing of applications and subscriptions for investment products issued by the Government, or the HKMA’s provision of financial market infrastructures and associated services; |
(d) | personnel records, used for recruitment and human resources management purposes; |
(e) | records collected via our websites, used for the purposes stated in section 3 below; |
(f) | records collected in connection with our initiatives to promote equal access to public services by persons of different backgrounds (such as promoting racial equality and inclusion), used for statistical and service monitoring purposes and for promoting equal access to public services; and |
(g) | other administration and operational records, used for various purposes depending on the nature of the record (e.g. for administration of functions and activities, for organising and delivering events, seminars and other promotional, educational and training activities, for visits to the HKMA and its Information Centre, for subscription of publications, etc.). |
Such personal data may include sensitive personal data. The provision of personal data is generally voluntary unless otherwise specified. A failure to provide the requested personal data, or the provision of inaccurate or incomplete information may result in us not being able to process your request, application, submission, enquiry, complaint or matter (as the case may be), or in us not being able to perform our statutory functions, responsibilities and administrative activities.
In performing our statutory functions, responsibilities and administrative activities, personal data held by us may be disclosed to relevant courts, panels, tribunals and committees, and/or other regulatory / government / judicial bodies in Hong Kong or elsewhere as permitted or required under the law, pursuant to any regulatory / supervisory / investigatory assistance arrangements between us and other regulators in Hong Kong or elsewhere, or persons engaged by us to assist us in the performance of our functions or responsibilities. Information collected in response to public consultation papers may be disclosed to members of the public in Hong Kong or elsewhere.
3. Personal data collected via forms / sections of our website
Without prejudice to our statement of practice on personal data held by us as mentioned above, generally:
(a) | The information you provide through the "Contact Us" section, the “Fintech Supervisory Sandbox" or other similar section / function on this website is used by us to respond to or handle your enquiries, comments, suggestions or matter, including any necessary follow-up work in connection with discharging our statutory functions and responsibilities, and for statistical and service monitoring purposes. The personal data will not be used for any other purposes, disclosed or transferred without your consent, unless such use, disclosure or transfer is permitted or required by law. |
(b) | Personal data collected from subscribers of the HKMA e-mail alert subscription service or other similar section / function on this website is used by us to alert you, to send you the requested information and to compile statistics of our readership. The personal data will not be used for any other purposes, disclosed or transferred without your consent unless such use, disclosure or transfer is permitted or required by law. |
(c) | Personal data collected through forms on our website is used, disclosed or transferred for the purposes as set out in the PICS for the relevant forms, and for discharging our statutory functions and responsibilities. |
(d) | Personal data collected through submissions in response to public consultation papers is used, disclosed or transferred for the purposes as set out in the PICS for the relevant consultation paper. |
(e) | Personal data provided in online complaint forms will be used, disclosed or transferred for the purposes as set out in the PICS for the relevant complaint form, including any necessary follow-up work in connection with discharging our statutory functions and responsibilities, and for statistical and service monitoring purposes. |
(f) | Personal data collected from job applicants who respond to a recruitment advertisement posted on our website is used for consideration of the applicants' job application, and for recruitment related purposes, and will not be used for any other purposes, disclosed or transferred without your consent, unless such use, disclosure or transfer is permitted or required by law. |
4. Information collected when you visit our website
Save as provided for in Section 3 above, when you visit our website we record your visit only as a "hit", which may show your Internet Protocol (IP) address and the pages you have visited. We do not collect any personally identifiable information under this circumstance. The information is used for the purposes of compiling statistical records, and for maintaining and improving our website.
When you browse our website, you should be aware that cookies are used. Cookies are data files stored on your computer's hard drive. Our website automatically installs and uses cookies on your browser when you access it. The types of cookies used on our website are session cookies and persistent cookies. The purpose of using cookies is to help us improve website performance and user's experience.
The cookies used in connection with our website do not collect or store personally identifiable information. You may refuse to accept cookies on your browser by modifying the settings in your browser or internet security software. However, if you do so, you may not be able to utilise or activate certain functions available on our website.
5. Retention
Different retention periods apply to the various kinds of personal data collected and held by us. We take all reasonably practicable steps to ensure that personal data will not be kept longer than is necessary for the fulfilment of the purposes (or any directly related purpose) for which the data is or is to be used, unless the retention is otherwise permitted or required by law.
6. Public registers
We are required to maintain public registers containing specified information pursuant to the relevant provisions of the Banking Ordinance and the Payment Systems and Stored Value Facilities Ordinance. In this connection, such public registers may contain certain personal data of individuals as required under the law or regulation, and the public in Hong Kong or elsewhere may inspect such public registers. Unless otherwise specifically provided for in the relevant enabling legislation or the relevant public register, the purpose of such public registers is to enable members of the public to ascertain whether a person is licensed by, registered with, or otherwise regulated by the HKMA, and to ascertain the registered particulars of such persons; you may only use the information provided in the public registers for such specified purposes. The foregoing equally applies to information in the public registers obtained through the Open Application Programming Interface on our website.
7. Security
We take appropriate steps to protect personal data we hold against loss, unauthorised access, use, modification or disclosure. All personal data you provide to us on this website is secured on our website.
8. Access and correction / enquiries
You have the right to request access to and correction of your personal data held by us in accordance with the provisions of the PDPO. Please note that all data access requests should be made using the form specified by the Privacy Commissioner for Personal Data which is accessible from the following link "Data Access Request Form".
When handling a data access or correction request, we will check the identity of the requestor to ensure that he/she is the person legally entitled to make the data access or correction request. We have the right to charge a fee for processing of any data access request.
We do not provide online facilities for you to delete or correct personal data held by us.
Any enquiries regarding personal data, or requests for access to or correction of personal data, can be made to the Data Privacy Officer of the HKMA by post or email.
Address: Hong Kong Monetary Authority, 55/F, Two International Finance Centre, 8 Finance Street, Central, Hong Kong
Email: publicenquiry@hkma.gov.hk