Post on 23-Dec-2015
Personal Data Privacy and The InternetPersonal Data Privacy and The Internetby
Stephen LauPrivacy Commissioner for Personal Data, Hong Kong SAR
at theJoint Conference of the OECD, HCOPIL, ICC
“Building Trust in the Online Environment:Business to Consumer Dispute Resolution”
The Crowne Plaza Promenade HotelThe Hague, The Netherlands
11 - 12 December 2000
1
Electronic CommerceElectronic Commerce
Consumer TRUST & CONFIDENCE
Identity of suppliers ?Integrity of information ?Electronic contract ?Payment reliability ?Errors/frauds ?DATA PRIVACY ?
2
Forrester Research, October 1999, USForrester Research, October 1999, US
• 90% of online consumers want to have control over how their personal data is used once it has been collected
• two out of three people say that they have reservations about giving out personal information online
• consumers who have moderate privacy concerns spend 21% less online than those who have less than moderate concerns
3
2000 Community Opinion Survey Importance of social policy issues in Hong Kong .
8.75
7.58 7.407.37 7.25
6.44
7.647.95
6.80
7.467.63
8.42
6.66
8.30
6.797.26
7.638.108.21
0
1
2
3
4
5
6
7
8
9
10
air pollution unemployment privacy food hygiene health services care for theelderly
sexdiscrimination
Mea
n va
lue
of re
spon
ses
1997
1998
1999
2000
0 = not important at all10 = very important
5
Personal Data (Privacy) OrdinancePersonal Data (Privacy) OrdinanceData Protection PrinciplesData Protection Principles
Principle 1 - Purpose and manner of collection -• this provides for the lawful and fair collection of personal
data and sets out the information a data user must give to a data subject when collecting personal data from the subject.
Principle 2 - Accuracy and duration of retention -• this provides that personal data should be accurate, up-to-
date and kept no longer than necessary.
7
Personal Data (Privacy) OrdinancePersonal Data (Privacy) OrdinanceData Protection PrinciplesData Protection Principles
Principle 3 - Use of personal data -• this provides that unless the data subject gives consent
otherwise personal data should be used for the purposes for which they were collected or a directly related purpose.
Principle 4 - Security of personal data -• this requires appropriate security measures to be applied to
personal data (including data in a form in which access to or processing of the data is not practicable).
8
Personal Data (Privacy) OrdinancePersonal Data (Privacy) OrdinanceData Protection PrinciplesData Protection Principles
Principle 5 - Information to be generally available -• this provides for openness by data users about the kinds of
personal data they hold and the main purposes for which personal data are used.
Principle 6 - Access to personal data - • this provides for data subjects to have rights of access to
and correction of their personal data.
9
Data Privacy Issues on InternetData Privacy Issues on Internet• no personal information collection (PIC) statement with on-
line data collection by websites• no display of data privacy policy statement with websites• data collection without consent (e-mail address, cookies,
etc.)• unfair collection (e.g. from children)• interception of data during transmission• use of data different from original purpose of collection• security of data held in websites• spamming• identity theft
10
Sample Survey of Hong Kong - Sample Survey of Hong Kong - Based Web SitesBased Web Sites
• Conducted between July to October 1998• Visited 531 sites from both public and
private sectors
11
ObjectivesObjectives• To assess the extent to which Hong Kong-based web sites
are operated in a manner that meets:
- the requirements of the Personal Data (Privacy) Ordinance
- standards of good and reasonable personal information handling
12
Provision of Personal Information Provision of Personal Information Collection (PIC) StatementCollection (PIC) Statement
339 sites had personal data collection forms
231 forms(68.1%)
108 forms(31.9%)
With PICStatement
WithoutPICStatement
13
Provision of Privacy Policy StatementProvision of Privacy Policy Statement
Only 21 sites had Privacy Policy Statements
318 sites(93.8%)
21 sites(6.2%)
WithPrivacyPolicyStatement
WithoutPrivacyPolicyStatement
14
Results of Compliance Check ExerciseResults of Compliance Check Exercise• 59 sites (25%) of 236 sites which have online personal data
collection form displayed a PPS
1999 Results
75%without
PPS
25%with PPS
1998 Results6.2%
with PPS
93.8%without
PPS
15
Results of Compliance Check ExerciseResults of Compliance Check Exercise• 220 sites (93%) of the 236 sites which have online personal
data collection forms displayed a PICS• Formal investigations being carried out into 16 sites (7%)
1999 Results
93%
7%
With PICS
Without PICS
236 sites have online personal data collection forms
1998 Results
68%
32%
WithPICSWithoutPICS
339 sites had online personal data collection forms
16
Guidelines on the Protection ofGuidelines on the Protection ofPersonal Data Privacy on the InternetPersonal Data Privacy on the Internet
• “Internet Surfing with Privacy in Mind” - A Guide for Individual Net users
• “Personal Data Privacy and the Internet” - A Guide for Data Users
• “Preparing On-line - Personal Information Collection Statements and Privacy Policy Statements”
17