MR CHAN CHUN-YING (in Cantonese):
Chief Executive, in Hong Kong, when individuals apply for loans from banks or financial companies, the relevant institutions will make enquiries with the TransUnion Limited (“TransUnion”), a business data company, about the applicants’ credit reports as reference for vetting loans, and the personal credit data maintained by TransUnion are provided by financial institutions, such as banks. In November last year, a media corporation easily passed the authentication process of TransUnion which holds the credit data of millions of Hong Kong people and downloaded your personal credit report and those of other senior officials. I think you have been feeling unhappy or at least uneasy about it. This incident has shown a leakage of personal data by a business data company to an unauthorized third party.
It has been six months now, and just this past Monday I put questions to the Hong Kong Monetary Authority (“MA”) about the latest development at a meeting of the Panel on Financial Affairs. I was given the reply that the final report of TransUnion on the incident had not yet been received but consideration would be given to introducing competition as a means to improve services. However, I also got news that the contents of TransUnion’s report have so far remained evasive and that it is unwilling to admit to the blunder.
In view of such a situation, may I ask the Government whether it will expeditiously review afresh the approach for monitoring business data companies, introduce more stringent guidelines and penalties, and confer more penal powers on the Office of the Privacy Commissioner for Personal Data and at the same time, enhance public awareness of privacy protection, in order to ensure that the personal data of Hong Kong citizens are afforded proper protection?
CHIEF EXECUTIVE (in Cantonese):
I thank the Member for his question. We attach great importance to the protection of personal privacy. This is particularly so in the financial realm because Hong Kong is an international financial centre and now we also wish to achieve rapid development in technology. Therefore, with regard to the question asked by the Honourable Member, I will ask the Financial Secretary to follow it up with MA.
MR CHAN CHUN-YING (in Cantonese):
Chief Executive, when the credit data of Hong Kong citizens are placed in the hands of business data companies, there is, after all, the possibility that such data are used for commercial purposes. To tie in with the introduction of electronic identity (“eID”) by the Government in 2020, may I ask the Government whether it will consider setting up on its own a Government-led personal database or credit database, so that the public will have more confidence in the protection of personal credit data?
CHIEF EXECUTIVE (in Cantonese):
With regard to the issue raised by Mr CHAN, I am afraid I do not have the required knowledge to give him a definite answer in this respect today. Having said that, the Innovation and Technology Bureau is actively promoting the development of Hong Kong into a smart city, including the eID programme mentioned by Mr CHAN. I think this issue can be referred to the relevant departments for further studies and we will give a reply to Mr CHAN as soon as possible.