Skip to content

Case Notes

Case Notes

This case related to DPP2 - Accuracy and duration of retention of personal data

Case No.:2009C08

Whether the Company had taken all practicable steps to ensure that the Complainant's address used by it was accurate

The Complaint

1. Summary of Facts

In December 2008, the Complainant applied for the credit card (the "Credit Card") from a financial institution (the "Company") and provided the Company with her address in Shek Tong Tsui ("Shek Tong Tsui Address") as her correspondence address. Later, the Complainant received a letter from the Company in which she discovered that the address district was "Siu Lam" (the "Wrong Address") instead of "Shek Tong Tsui". The Complainant therefore requested the Company to correct the address by submitting a Change of Customer Information Request Form (the "Request Form") together with a copy of her credit card statement issued to her by another bank as her address proof.

In January 2009, the Complainant noted from a letter issued by the Company that the address stated therein was still the Wrong Address. The Complainant telephoned the service hotline of the Company and a hotline staff member agreed to make the correction.

In February 2009, the Complainant was informed by the Company the credit card statement of January 2009 was sent to an address without flat and floor number (the "Incomplete Address"). The Company agreed to issue a new credit card to the Complainant. Later, the Complainant received a new credit card but she found that the address appearing in the credit card statement of January 2009 was the Incomplete Address.

The Complainant therefore made a complaint with this Office against the Company.

2. Information provided by the Company

The Company explained that as there was no "Shek Tong Tsui" in their pull down manual of the system, their staff had chosen "Western" as the Complainant's district. Upon verification with the Complainant that her district should be "Shek Tong Tsui", the staff member had however mistakenly inputted "Siu Lam" into their computer system. The staff member responsible for double check was unable to spot such mistake.

The Company admitted that they had sent the credit card statement of January 2009 to the Incomplete Address as the staff failed to fill in the flat and floor of the Complainant's address upon receiving the Request Form. The Company also claimed that they could not find the address proof as alleged by the Complainant.

The Company stated that the Complainant's address had been corrected.

3. Issues of the case

Whether the Company had taken all practicable steps to ensure that the Complainant's address used by it was accurate.

Outcome

1. Reasoning

Investigation revealed that the mistakes were made by employees of the Company due to carelessness. Hence the Company had breached DPP2(1) of the Ordinance for failing to take all reasonably practicable steps to ensure that the Complainant's address used by it was accurate.

2. Action by PCPD

An enforcement notice was served on the Company directing it to conduct regular administrative audits in relation to customers' requests for updating personal data.

3. Improvement Action by PCA, if any

The Company had complied with the enforcement notice.

uploaded on web in February 2011


Category : Provisions/DPPs/COPs/Guidelines : Topic/Subject Matter :