Date: 24 November 2021
Privacy Commissioner Received Nearly 50 Complaint Cases about the Handling of Registration Data of Visitors
To enhance the epidemic control capacity to protect members of the public, the Government announced that starting from 9 December, the requirement to use the “LeaveHomeSafe” mobile application (“LeaveHomeSafe”) will be extended to all premises regulated under the Prevention and Control of Disease (Requirements and Directions) (Business and Premises) Regulation (Cap. 599F), including restaurants, fitness centres, etc. This means that all visitors to the premises must first scan the “LeaveHomeSafe” venue QR code using the “LeaveHomeSafe” mobile application before entering such premises.
Since the launching of the “LeaveHomeSafe” on 16 November 2020, the Office of the Privacy Commissioner for Personal Data (PCPD) has received a total of 49 complaints relating to the handling of the registration data of customers or visitors, involving 31 restaurants and 18 other premises (such as commercial buildings, clinics, private clubs, recreational venues, etc.). Among the 38 completed investigations, 15 complaints were found substantiated, all of which related to the data security of the registration data of customers handled by the restaurants involved. The PCPD has issued Enforcement Notices to the 15 restaurants in question to request them to implement appropriate and practicable measures to protect the registration data of customers.
The Privacy Commissioner for Personal Data, Ms Ada CHUNG Lai-ling, said, “From the perspective of protecting personal data privacy, storing one’s own data in one’s mobile phone by using “LeaveHomeSafe” is better than providing the personal data on paper registration forms to the operators of different premises every day.”
During the same period, the PCPD has received two complaints about “LeaveHomeSafe”. The complainants were concerned about whether the mobile app had location tracking function and if the access permissions required for the app to function were excessive. After investigation, the PCPD found both complaints unsubstantiated, as there was no evidence to show that “LeaveHomeSafe” has location tracking function. It was also found that the access permissions relating to “LeaveHomeSafe” are all operationally required for the functioning of the app.