(24 March 2015) The Office of the Privacy Commissioner for Personal Data ("PCPD") has the following comments in response to the two direct investigation reports issued by The Ombudsman today.
1) Direct Investigation into Education Bureau's Non-disclosure of Teachers' Registration Status
(a) The Ombudsman urges the Education Bureau ("EDB") to review its current practice relating to handling of requests from individuals / organisations to access information on the registration status of individual teachers, with a view to adopting a more accommodating approach in considering requests made by those whose vital interests are affected.
The PCPD supports this suggestion. The EDB should consider the circumstances of the request and professionally apply the Personal Data (Privacy) Ordinance ("Ordinance") to determine whether to accede to the request and if yes, the exact personal data to be disclosed to the requester. The Ordinance is not a straightjacket which prohibits disclosure of the personal data in all circumstances.
(b) The Ombudsman also urges EDB to conduct an extensive public consultation exercise or opinion poll to confirm the public's aspirations for disclosure; if the results indicate wide public demand for disclosure, EDB should expeditiously consider amending the relevant procedures and legislation to implement the measure.
The PCPD sees no objection to this suggestion. Public consultation will provide a mandate for a framework of determining factors to consider whether or not to disclose the teachers' personal data upon request, and if yes, the exact personal data to be disclosed to the requester. Legislative provisions will provide an indisputable legal footing for the framework.
2) Direct Investigation into Recovery of Debts under the Non-means-tested Loan Scheme
The PCPD noted that among other suggestions, the Ombudsman has resurrected a proposal (the "Proposal") the Working Family and Student Financial Assistance Agency once considered to deter default on loan payment, namely, forwarding the borrower's default data to the consumer credit reference agency (the only agency of this kind operating in Hong Kong is TransUnion). PCPD objected to the Proposal because of its grave privacy ramifications. This position was supported by the findings of a public opinion survey (the "Survey") conducted in February 20121 .
To recapitulate, while the PCPD is in support of the Ombudsman's suggestions to tighten up procedures to recover debts under the Loan Scheme, it is against the Proposal for the following reasons:-
(a) The handling of consumer credit data in Hong Kong is a closed system involving almost exclusively only TransUnion (as the consumer credit reference agency) and the banks and money lenders (providing credit data to TransUnion on the one hand and extracting credit data from its database for assessing the credit worthiness of their customers on the other). It is presently tightly regulated by the PCPD. The Proposal will open a floodgate to requests of a similar nature from (i) other government departments for recovery of overdue taxes, government rents and rates, water charges, etc. and (ii) private sector sources such as retail, small business, telecoms, utilities and others which are also keen to recover outstanding debts from their customers. The resultant open system will not be amenable to the same degree of regulation by PCPD.
(b) The Proposal entails the transfer of the borrowers' very private and sensitive data from a Government agency to TransUnion, a commercial enterprise which is not subject to the direct oversight of the Hong Kong Monetary Authority as the financial regulator. Importantly, TransUnion's majority shareholder is not Hong-Kong based.
(c) How TransUnion computes a credit score for individual consumers based on the credit information it held is unknown. This black box operation does not matter much in the present closed system as the banks and money lenders, being both contributors and beneficiaries of the credit data, have a vested interest themselves in the successful operation of the credit reference agency. Indeed the major banks have a minority shareholding interest in TransUnion and therefore should have a say in its operations. On the contrary, organisations outside this closed system have absolutely no control over the effect on the borrower after unilaterally contributing credit data to TransUnion. In other words, whether the Proposal would produce an insignificant or a disproportionately negative effect on the borrower is anyone's guess. The Ombudsman's suggestion that the Proposal will generate a deterrent effect is purely speculative.
(d) The Survey revealed that the respondents' support for the Proposal dropped from 60% to 35% after learning the privacy implications above.
The PCPD noted that although the above privacy concerns have been made known to the Ombudsman, they were not fully addressed in her investigation report.
"I fully support that the Administration should step up its efforts to tackle the student loan default problem. However, the proposal to share with TransUnion the negative data of defaulters in some 600 cases2 has serious privacy implications for the whole community and its deterrent effect is unknown due to the lack of transparency of the operations of this credit reference agency as regards credit rating. There are also clear indications that the students and the general public, with full knowledge of the privacy implications, are largely against the proposal. Against this background, I repeat my previous recommendation to the Administration that they should look for other less privacy-intrusive measures such as (a) enhancing the efficiency and effectiveness of the legal process to recover default loans, (b) using debt collection agency, and (c) imposing penalties against defaulters", The Privacy Commissioner for Personal Data, Mr. Allan Chiang concluded.
- End -
1 Please see PCPD's media statement dated 29 February 2012 at http://www.pcpd.org.hk/english/news_events/media_statements/press_20120229.html
2 It is understood that the Administration intends to restrict the application of the Proposal to the relatively more serious default cases, say, those with more than $100,000 in default and have ceased repayment for more than a year without any reasonable justification. There are about 600 cases which meet these criteria as at end of July 2011.