It would not be appropriate for us to comment on individual cases or a specific practice without the details of the facts and specific circumstances. Nevertheless, all e-Wallet operators, as data users, must comply with the requirements under the Personal Data (Privacy) Ordinance (“Ordinance”) including the six Data Protection Principles (“DPPs”) which regulate organisations (as the “data users”) engaging in the collection, holding, processing and use of personal data.
In the present context, section 26 and DPP2(2) in Schedule 1 of the Ordinance will be of particular relevance. Pursuant to DPP2(2), all e-Wallet operators must take all practicable steps to ensure personal data is not kept longer than is necessary to fulfil the purpose for which it is (or is to be) used. Section 26 further requires operators to take practicable steps to erase the personal data held by them where it is no longer required unless the erasure is prohibited by any law. However, both section 26 and DPP2(2) do not stipulate a fixed period of retention of personal data. In other words, an e-Wallet operator may retain the data if there is subsisting purpose e.g. as required by or permitted under the laws. For example, section 51C of the Inland Revenue Ordinance requires that any person carrying on any trade shall keep sufficient records for a period of not less than 7 years after completion of the transactions. Besides, paragraph 8.4 of the Guideline on Anti-Money Laundering and Counter-terrorist Financing (for Stored Value Facility Licensees) (September 2016) issued by the Hong Kong Monetary Authority states that records relating to customer identity and transactions should be kept throughout the business relationship with the customer and for a period of 6 years after the end of the business relationship.
We have initiated a compliance check into the permanent retention of customers’ data as suggested.
In order to address the privacy issues related to the e-Wallet, a media statement was released on 25 August 2016 by us to provide practical tips and advice to both e-Wallet users and operators. (The said statement can be downloaded from https://www.pcpd.org.hk/english/news_events/media_statements/press_20160825.html).
The information can be attributed to the spokesperson for the PCPD.