Disclosure of a customer's payment information to a third party by a travel agency – DPP 3 – use of personal data
The Complaint
Miss A, a regular customer of a travel agency, recommended the Complainant to purchase a flight ticket from that travel agency. The Complainant failed to pay the balance and the agency was unable to get in touch with the Complainant. The travel agency then sent an email to Miss A, asking for the address of the Complainant but the email disclosed the details of the Complainant's overdue payment. The Complainant considered that the travel agency should not have disclosed his payment information to Miss A and the purpose of such disclosure was to exert pressure on him. Hence, the complainant made a complaint with the PCPD.
Outcome
The PCPD found that even though the travel agency was unable to reach the Complainant and had to ask his referee for his contact address, it was unnecessary for the travel agency to disclose details of the overdue payment to the referee.
After the PCPD's intervention, the travel agency undertook not to disclose unnecessary information of customers to third parties in similar circumstances.
Regarding the incident, the PCPD issued a warning to the travel agency, requesting it to regularly remind its staff members of the relevant requirements under the PDPO and implement measures to ensure compliance.
Lesson learnt
DPP 3 requires that personal data shall only be used for a purpose that is the same as or directly related to the original collection purpose.
The financial status of a customer, such as default in payment, is commonly considered sensitive data. Such data should be handled with extra care and only be disclosed to a third party when there is a genuine need. If a referee is contacted to locate a customer, only the minimum data for identification should be shared. Excessive disclosure of personal data (e.g. payment details) to a referee may contravene the requirements under DPP 3.
(Uploaded in March 2022)