Speech of the Hon KP Chan to move amendments to Member’s motion on better protection of personal data privacy:
MR PRESIDENT, the Personal Data (Privacy) Ordinance has been in force for over 10 years. All along, the direct sale industry has been operating under advice of legal counsels to ensure compliance in mode of operation and business activities. Actually, Office of the Privacy Commissioner for Personal Data is receiving 900 complaints a year on average. Some of them concern direct sale and they are duly investigated. However, Office of the Privacy Commissioner has never revised its guidelines as a result of these investigations. The industry had never doubted that its operations were complying with the law and practitioners were actively developing their business. It was not until the Octopus incident that Office of the Privacy Commissioner ruled that the established practice was breaching the law. He also issued new Guidelines on the Collection and Use of Personal Data for Direct Marketing earlier on Monday. Today, the whole society is pointing finger at the direct sale industry. Many practitioners are suspending their telemarketing activities. Business is seriously disturbed and many workers are losing their jobs.
Both the original Motion and my Amendments concern protection of consumers. I fully agree that consumer interest is of utmost importance, but we should consider this issue fairly and squarely and beware of overregulation. As we advocate better protection of consumer privacy, we should not cause undue threats to survival of the direct sale industry.
Let me first highlight social contributions of the direct sales industry as the public is unfamiliar to its operation. According to industrial survey, more than 20 percent of respondents would purchase insurance from direct sale because of convenience and competitive pricing. The same survey also reveals that many people are not resistant to buying through direct sale. Otherwise, the direct sale industry would hardly survive.
Let me also tell you a true story. I was told by the industry that one gentleman, who should remain anonymous of course, applied for a credit card some time ago. A business partner of the credit card issuer sold him a life insurance policy through telemarketing. Tragically, he died in the recent hostage accident in the Philippines and his family benefited from additional protection of this policy. This story is but one of tens of thousands of successful cases of direct sale each year. There are also tens of thousands of people getting claims in millions of dollars annually.
Another case in point is the telecommunications industry. I trust many people got to know the most favourable package offered in the market through telemarketing calls and some have elected to subscribe.
On the other hand, information provided by the industry association of direct sale also shows that there are some 30,000 telemarketers and over 300 have lost their job after the Octopus incident. If the situation further deteriorates, more telemarketers would become unemployed. I trust all of you may realize that the educational level for direct sale is secondary schooling and such jobs are getting less in Hong Kong. Are we not urging the Government to create more job opportunities for the lower class? Are jobs in direct sale not deserved retention?
Moreover, direct sale is a kind of job that is done through telephone and it is suitable for at least some of the underprivileged. For instance, the industry is hiring the physically handicapped. It is estimated that as many as one-quarter of workers are part-time. The industry is also hiring people suffering from chronicle illness, housewives and casual workers. They are earning a decent living with their choice of working hours that suit their physical conditions and time schedules.
I ask all of you to pause and look around how many more jobs of such kind are still available in Hong Kong? If we impose stringent regulations on the direct sale industry that might threaten its survival, tens of thousands of workers would eventually lose their jobs. This number does not include ancillary jobs that are supporting the industry.
Apart from telemarketing, other kinds of direct sale including postal mailing, short messaging and emailing are also regulated under the same law in practice. If stringent regulations are introduced, they are equally affected. The industry estimates that more than 100,000 people are engaged in direct sale and related services.
In fact, law-abiding direct sale agencies are complying with the code of practice to protect customer privacy. For example, they only share selective personal data like name, age and telephone, etc as required, not the complete customer profile, with business partners in marketing activities. Moreover, customer data are always encrypted to prevent unauthorized access and decryption may only be made by in-house programmes. Furthermore, work stations of marketers are not accessible to the Internet. Also, use of consumer data is closely monitored to prevent unauthorized duplication.
As mentioned, the industry association has promulgated code of practice for members to follow. For instance, telemarketers are required to identify themselves and state their purposes in making calls. Customers who expressly decline telemarketing calls will be removed from the contact list because it is a waste of time to call again those who would not make purchases.
As in all industries, there are black sheep in direct sale. They simply ignore the law and do not pay attention to customer data protection. Malpractices of annoyance and leakage are mostly undertaken by those unscrupulous practitioners.
Earlier on Monday, the Government proposed to amend the Personal Data (Privacy) Ordinance next year following public consultation. One of the proposals is to make contravention indictable as an offence. Many direct sale organizations are indicating support of such course, subject to scrutiny of details of course, to demonstrate their determination to clamp down malpractices.
Their acceptance of criminal liabilities in the regulation of use of personal data is indicative of determination and self-confidence of the industry as well.
Those stringent regulations that I mention repeatedly earlier are the proposed adoption of “opt-in” by the Privacy Commissioner (ie what the Government now refers to as the “acceptance” arrangement) to replace the universally accepted “opt-out” (ie what the Government now refers to as “refusal” arrangement). What is meant by “opt-out” is an express choice of refusal by customers at the time of enrolment. If the customer does not choose to “refuse”, his personal data would be available for direct marketing.
In reality, it is habitual behaviour that people are usually more passive in respect of insignificant issues. If “opt-in” is used instead, the outcome will be most people not acting to choose “acceptance”. The direct sale industry estimates that only 1 percent would choose to “opt-in” and obviously the industry would not survive in consequence. Accordingly to information provided by industry organizations, developed countries that are serious in protecting personal privacy including the US, UK, Canada, France, Germany. Australia, New Zealand, Japan, Korea and Singapore have all adopted “opt-out” for telemarketing after duly weighting advantages against disadvantages to all parties.
Let me now briefly explain my Amendments. They are proposed with a view to calling for proper balance in revising regulations. We should not only ensure all businesses are operated under the law but also beware of undue threats to survival of the direct sale industry. Moreover, pros and cons of “opt-in” and “opt-out” in practice should be thoroughly considered in light of overseas experiences and local circumstances. The public should be allowed to express an informed preference rather than making an immature choice at this juncture. Also, in my view, notification of whether personal data might be transferred to third parties should have been made at the time collection. Therefore, if such data were used for any other purpose, separate authorization from data subjects should be required.
Also, I propose to change the phrase “earning a profit of HK$44 million” to “earning an income of HK$44 million”. The sum quoted by Octopus is gross revenue before operating expenses including the substantial cost for computer systems; it is income not profit.
In its paper for public consultation on amendments to the Personal Data (Privacy) Ordinance, the Government proposes that data user should provide an “opt-out” choice to data subjects in the collection of personal data for direct sale. The Government also says the authority is open-minded in the eventual decision of “opt-in” or “opt-out” for sharing personal data. The official position is actually consistent with my Amendments.
To conclude, I urge fellow Members to support my Amendments. While we endeavour to better protect personal data, we should also consider the established practices in other countries and should beware of undue threats to survival of the direct sale industry.
With these remarks, Mr President, I move my Amendments to the original Motion.