Community Development Initiative (CDI) statement towards the Report on Public Consultation on Review of the Personal Data (Privacy) Ordinance

Community Development Initiative would like the Constitutional and Mainland Affairs Bureau to take into account the following regarding the Report on Public Consultation on Review of the Personal Data (Privacy) Ordinance.

1. Revamping Regulatory Regime of Direct marketing

We suggest the government should impose the followings:

• To require data user to obtain explicit and voluntary consent of data subject to use personal data for direct marketing purpose.

• Data user should have the responsibilities to explain how they are going to handle the data, and how they are going to use it before they are trying to collect the data.

• A “do not call” list should be set up and data collectors should have the responsibilities to check up before calling out.

• Individuals should have universal access to verify with the “do not call” list  

• Individuals also have rights to be informed of the source of personal data from direct marketers.

2. Sanctioning Power

• We believe that PCPD are more familiar with the privacy ordinance than other bureaux.  We agree that PCPD should be granted Criminal Investigation and Protection Power.

3.  Trans-border issues

• We aware that personal data could be transferred from Hong Kong across the borders to regions might have weak data privacy protection regulatory framework.

• Therefore, we suggest the government should regulate the transfer of the data across border.

• Hong Kong can transfer the data to countries that hold similar or tighter standards on data protection regulation.

• We believe that a proper data handling system could become an asset of Hong Kong, as business sectors are willing to operate calling centres in area with clear regulatory framework.

4. Data Privacy Audit

• In long run, the executive should consider the feasibility of implementing data privacy audit among companies in certain scale/size.