(1 December 2015) The Office of the Privacy Commissioner for Personal Data ("PCPD") conducted an assessment of 45 local websites and mobile applications ("apps") targeting at children this year. The results show that some websites and mobile apps contain good privacy practice while others are not satisfactory.
2. This year's study was part of the Global Privacy Enforcement Network ("GPEN") Sweep exercise that took place in May this year. PCPD joined forces with 28 other privacy enforcement authorities around the globe to examine the privacy protection of 1,494 websites and mobile apps targeting at children.
The Study Findings
3. The following findings are worthy of mention in the case of Hong Kong:
I. 36% of websites were found to ask for children's HK Identity Card Numbers;
II. 49% of websites were found to have indicated in their privacy policies that they might share the collected personal data with third parties.
4. When comparing with the results of the global examination, the following figures from the local study are also notable:
I. 27 websites (60%) sought information on children's home addresses while 33 websites (73%) collected their phone numbers. These figures are much higher than those global figures of 19% and 22% respectively;
II. 16 websites (36%) sought information from children concerning third parties (parents and friends). Again this figure is higher than the global figure of 18%;.
III. Only two websites (4%) provided accessible means for a child to delete his account, which is much lower than the global figure of 29%.
Reading the study report on line: www.pcpd.org.hk/english/resources_centre/publications/surveys/files/sweep2015_e.pdf
PCPD's recommendations
5. To follow up on the findings, the PCPD has released a publication entitled Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children to provide practical suggestions and good practice. For example:
a) One way to avoid and reduce the collection of personal data of children and the third parties is to avoid the use of open-type questions;
b) Organisations should offer means for children to remove the accounts and all associated personal data;
c) Organisations should obtain the consent of children, their parents or guardians before using the collected personal data for a new purpose.
d) One way to safeguard the personal data is to encrypt it, and
e) Ways to offer easily-understood, user-friendly and age specific information to children and their parents regarding privacy policy and practice.
6. In May 2015, PCPD released an exploratory study which was carried out to identify major privacy concerns and problems faced by children in Hong Kong. The results showed that parents and teachers seem to have insufficient awareness about children's privacy issues. In addressing these issues, PCPD has published a Children Online Privacy – practical tips for parents and teachers. Recommendations include:
a) Active Participation–Parents and teachers are encouraged to engage with children in the online activities and understand the operation of the online world.
b) Basic Steps for Children Privacy – Suggestions are provided on security measures, digital footprints, privacy settings and respecting the privacy of family members and friends.
c) Setting a Good Example– Parents and teachers are role models for children. They should set good examples by protecting their own personal data and respecting others' personal data privacy.
7. PCPD has also revamped a thematic website "Children Privacy"(www.pcpd.org.hk/childrenprivacy/index.html), which is a one-stop portal to provide teachers and parents with practical tips and teaching resources on personal data protection for children.
Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children www.pcpd.org.hk/english/resources_centre/publications/files/guidance_children_e.pdf
Children Online Privacy – practical tips for parents and teachers www.pcpd.org.hk/english/resources_centre/publications/files/leaflet_childrenonlineprivacy_e.pdf
The Privacy Commissioner for Personal Data , Mr Stephen Wong, stressed, "Collection of third party's personal data from young children may in some circumstances amount to unfair collection contrary to Data Protection Principle 1(2)(b) of Schedule 1, Personal Data (Privacy )Ordinance Cap 486 Laws of Hong Kong.
Mr Wong added, "On respecting the personal data privacy of others, parents and teachers should set an example by consulting their friends or third parties before sharing their personal data. In terms of sharing children's information (such as photographs, examination results and participation in sporting events), parents and teachers should invariably take into account the interest of the children, including any harm and potential embarrassment in the future. However, as children's expectations on privacy and ability to make decisions may vary depending on individual maturity and intellectual development, parents and teachers are encouraged to discuss with them frequently and frankly on their online practices."
- End -