Date: 19 June 2021
The PCPD Reminds the Public to Safeguard Personal Data Privacy
When They Participate in Lucky Draw Activities
The Office of the Privacy Commissioner for Personal Data (PCPD) noted that, in order to encourage more citizens to receive COVID-19 vaccination, many organisations have launched various lucky draw activities which may involve the collection of participants’ personal data.
The PCPD reminds members of the public to stay vigilant if the provision of personal data is required when they participate in any lucky draw activities. They should pay attention to the information released by the organisers, including the Personal Information Collection Statement, in order to ascertain the correct websites or methods for registration; the requisite personal data to be provided; the purposes of collection and the retention period, etc. They should also be cautious of phishing websites.
The Privacy Commissioner for Personal Data, Hong Kong, Ms Ada CHUNG Lai-ling, said, “Criminals may take advantage of the citizens’ interest in lucky draw activities to induce citizens to provide their personal data. Apart from being cautious of phishing websites, I would like to remind members of the public to stay vigilant when they receive any calls, text messages or emails which are suspicious or from unknown sources. They should avoid disclosing their personal data arbitrarily, including Hong Kong Identity Card numbers and bank account numbers, etc., and avoid clicking links or opening attachments in emails or text messages at will.”
Given that a substantial number of participants may be involved in lucky draw activities organised for the general public,
the PCPD urges organisations to handle personal data prudently when they organise lucky draw activities to ensure compliance with the provisions of the Personal Data (Privacy) Ordinance. The PCPD would like to highlight the following points in particular:
-
The personal data collected should be necessary but not excessive. The purpose of collection should be directly related to the lucky draw activities. The means of collection should be lawful and fair. Organisations should take practicable steps to inform participants of the purpose(s) of using their data and the classes of persons to whom their data may be transferred, etc.;
-
After the original purpose(s) of the collection of the data has been fulfilled, the personal data collected should be erased as soon as practicable;
-
The use of personal data is restricted to the purpose(s) stated at the time of collection (e.g. to participate in the lucky draw activities) or a directly related purpose. Except with the data subjects’ express and voluntary consent, the data should not be used for other purposes, including the promotion of goods or other activities; and
-
All practicable steps should be taken to protect the personal data against unauthorised or accidental access, processing, erasure, loss or use.
-End-