Octopus Cards Limited

Controversy over use of personal data

In mid-2010, some individuals complained that they had received unsolicited sales calls which they alleged came from business partners of Octopus. Octopus chief executive Prudence Chan initially denied that any personal data had been given over to third parties, but said that cardholders' consent to use their data would have been given when they registered for the Octopus reward program, which had an opt-out mechanism. The company came under fire for deception when a former worker at The Cigna Group said that Octopus had bought data on 2.4 million reward scheme cardholders. At a hearing before the Privacy Commission on 26 July 2010, it was subsequently revealed that Octopus had entered into partnership agreements through which card-holders' personal details were sold to Cigna and others for HK$44 million. The company disclosed that personal data collected from Octopus rewards program had been sold to six vendors since 2002, and that two such relationships were still current. The company was further criticised when it was revealed that there were no safeguards on the transfer or reuse of the personal data to parties outside of Hong Kong. Chan apologised before a Legislative Council's finance affairs panel meeting; she said that she "might have used a wrong definition of selling [personal data] at the time." Legislators from all parties demanded Chan's resignation for attempting to mislead the public.