Response to Media Enquiry or Report

Date: 16 May 2018

Response to Media Enquiry on Children Privacy Issues with Tik Tok

Thank you very much for your email enquiry. Our consolidated response from the perspective of personal data privacy follows:
 

• Some people, particularly children, may be less vigilant about safeguarding “indirect” or seemingly less sensitive personal data such as photos, videos, schools attended and location trails. People need to be aware that when sufficient amount of indirect information is gathered, their identities may be ascertained by others without their knowledge.

 

• The objective of the Personal Data (Privacy) Ordinance (the Ordinance) is to protect the privacy rights in relation to personal data[1] of living individuals (as data subjects), regardless of their age.  Data users that control the collection, holding, processing or use of the personal data should comply with the requirements under the Ordinance, including the six Data Protection Principles.

 

• Undoubtedly, children are a vulnerable group who need special attention in privacy protection, particularly in the context of online activities. The Privacy Commissioner therefore has been encouraging data users targeting children to process children’s personal data lawfully and responsibly.  The information leaflet “Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children” highlights essential points relevant to data users who interact with children via the Internet. To protect children’s privacy online, social media platform operators, as data users, should:
  • avoid collect personal data from children, given that children may not fully understand all the privacy risks;
  • ensure that children understand the privacy implications when offering discussion forums to them;
  • encourage children to involve their parents or teachers when collecting personal data from them;
  • ensure that children are well informed of their rights and offer them with an easy and online way to completely remove personal data;
  • provide clear notice to children on or before collecting their personal data if those data is to be published via online platforms, and provide means to enable children to opt-out of such publications;

 

• It may be somewhat unrealistic to prevent children from using social media platform altogether.   Children should protect themselves by being vigilant when posting personal information on social media platform.  They should:
  • think before they post as there is no simple “delete” button once their personal data is disclosed online;
  • avoid providing excessive personal data (for example: when they create their accounts, they have to consider the genuine need to provide each piece of personal data and whether supply of the data is obligatory) ;
  • create different groups of friends to limit the posted information that each group can see on social networks;
  • regularly check the privacy setting pages to see what kinds of personal data are being shared and how; and
  • seek permission from others before posting their pictures or identifying them in their posts.

 
More tips on how to protect personal data privacy when using social network platforms can be found in this Office’s information leaflet “Protecting Online Privacy – Be Smart on Social Networks”. 
 

• The Privacy Commissioner has continuously devoted resources to raise young people’s awareness of protecting their own personal data.  On a regularly basis, we visit primary and secondary schools to deliver presentations on the subject.  This year, we have partnered with South China Morning Post to roll out the Student Ambassador for Privacy Protection Programme – Partnering School Recognition Programme.  Targeting secondary school students, the programme engages students to complete a series of missions related to privacy protection by stages and partnering schools will be awarded accordingly. 

 

• Another educational campaign targeting primary schools has just been rolled out, offering a range of interactive educational activities and competitions engaging younger children and their parents to raise their awareness of personal data privacy protection. 

 

• Parents and teachers have an important role to play in protecting children’s personal data privacy, particularly in instilling in children the concept of thoughtfulness in sharing information online and guarding against cyberbullying. The Privacy Commissioner has issued a leaflet entitled “Children Online Privacy – Practical Tips for Parents and Teachers” that provides tips for parents and teachers to take precautionary steps for protecting children privacy.  Parents and teachers should:
  • gain first-hand knowledge in online platforms / systems by using them so that parents and teachers can share their experience and communicate with children on how to protect the personal data privacy right;
  • find suitable ways to engage with children in their online activities;
  • remind children not to rush to provide or share information when registering for a new service or using it, and encourage children to consult them before providing or sharing their personal data;
  • sensitise children to examine the privacy settings critically before choosing to use new platforms / systems;
  • warn children that sharing information including photos online willingly or inadvertently means that the information will be accessed by members of the public;
  • children should be made aware that they should turn to their parents or teachers when faced with cyberbullying.

 

• The PCPD has developed a thematic website called “Children Privacy”, which is a one-stop portal for children to learn and understand personal data privacy, as well as for teachers and parents to help those under their care in protecting their personal data. 

 

• Between 1 July 2016 and 15 May 2018, the PCPD did not receive any complaints about Tik Tok.

 
Between 1 Jan 2015 and 15 May 2018, the PCPD received 112 complaints relating to cyber-bullying on social media.


We cannot disclose information about specific cases to maintain statutory secrecy requirements.  Relevant examples can be found in the leaflet “Cyber-bullying – What you need to know” issued by the Privacy Commissioner. 
 
 
 
 
The information can be attributed to the Privacy Commissioner for Personal Data, Mr Stephen Kai-yi Wong.