Hong Kong e-payment firm admits selling customer data

Hong Kong's Octopus Holdings has admitted to selling its customers' personal information since January 2006 and pocketing HK$44 million (US$5.7 million) from doing so.

The e-payment services provider said it sold personal data belonging to 1.97 million customers to six companies including Cigna Worldwide Life Insurance, according to a report from local broadcaster Radio Television Hong Kong.

Octopus CEO Prudence Chan, who was speaking at a private hearing with the Hong Kong Privacy Commission, was quoted as saying the company has pledged not to provide personal data to other companies in future.

Octopus had earlier denied it sold customer data, until it was called up by the Commission to testify at an official investigation of the company's practices, noted a report by Apple Daily. Chan then retracted the denial.

Octopus' contactless payment cards are used widely by commuters of Hong Kong's underground trains operated by MTR, which incidentally owns 57.4 percent of Octopus shares, and also for various transactions such as fast-food outlets and convenience stores.

Noting that the two companies are separate and operate independently, MTR spokesperson Diana Yue said in a Bloomberg report: "[Octopus must] fully cooperate with the relevant bodies, taking solid steps to eliminate the concern in the minds of the people."

Cigna also issued a statement noting that it is cooperating "fully" with the Privacy Commission. The insurance company said "the highest controls and standards have always been maintained with the limited customer personal data" that was provided by Octopus.

In an article published today, Apple Daily reported that the Hong Kong Privacy Commission will propose the introduction of a new law to ban companies from selling customer data.

Chan is now facing pressures to resign for her mismanagement and initial denial about her company's actions.