By Claire Chow

Hong Kong, 9 June 2023: Operators of credit reference systems are advised to implement robust data protection measures and comply with relevant industry rules or face the risk of legal fallout. The warning follows an investigation by the Privacy Commissioner into unauthorised access to one particular credit database which revealed it to be unregulated and beset by major security failings.

The lengthy investigation by the Office of the Privacy Commissioner for Personal Data focused on the so-called TE Credit Reference System operated by Softmedia Technology Company Limited. It was initiated after a citizen complained his credit data had been accessed a number of times by eight money lending companies unknown to him without his knowledge or consent.

The probe revealed the TE Credit Reference System contained the data of about 180,000 borrowers and was used by some 680 money lending companies. But it was not one of the service providers under Hong Kong’s new Multiple Credit Reference Agencies Model – launched last November to strengthen industry governance and resilience – and thus was not regulated by the sector’s authorities or laws covering the financial professions.

Following the investigation, Privacy Commission Ada Chung published a report which found operator Softmedia was responsible for three significant security deficiencies:

Failure to protect personal credit data from unauthorised access: Softmedia failed to implement appropriate security measures to manage access to, and use of, the TE Credit Reference System. The investigation found money lenders could gain unlimited access to a borrower’s credit data for five days with a payment of just $2, and this five-day cycle could be repeated with no limits set in terms of payment or access. Further, Softmedia allowed this access without ensuring borrowers had given their consent. “This arrangement falls far below the general standard and is highly disappointing, both in terms of compliance with legal requirements and the protection of borrowers’ privacy,” says the report.

Weak password management: Despite the volume and nature of the data in question, Softmedia failed to adopt a robust login policy or set expiration dates for passwords. Passwords were allowed that would generally be considered weak in terms of length and complexity. It also meant staff could still access the system even after they had left the money lending company.

Prolonged retention of data: Softmedia retained over 50,000 credit records of borrowers who had completed their repayments more than five years previously. The report notes “this constitutes unnecessary and prolonged retention” while “also exposing the personal data of the borrowers concerned to risks of data breach”.

Ms Chung concluded Softmedia had failed to adequately protect the personal data in the TE Credit Reference System, thus contravening Data Protection Principle 4(1) in Schedule 1 of the Personal Data Protection Ordinance (Cap 486) (“PDPO”), and had also failed to ensure the data was not kept longer than necessary, therefore breaching Data Protection Principle 2(2). She served an enforcement notice on Softmedia, directing it to remedy the contraventions and prevent recurrence.

“The fact that the operation and management of the TE Credit Reference System is not regulated by any industry code or relevant laws of the financial sector is far from satisfactory,” concluded Ms Chung. “To ensure the protection of borrowers’ personal data and the data security of the credit reference database, I recommend that the operation and management of any credit reference database should be regulated or supervised through laws, regulations, guidelines, industry codes or licensing systems.”

She made the following recommendations to operators of credit reference databases:

• Implement a personal data privacy management programme to improve governance.
• Appoint data protection officers to monitor compliance with the PDPO.
• Appoint an independent compliance auditor to conduct regular checks.
• Increase penalties – for example, terminating access to the database – for those money lenders who violate terms of use.

In conclusion, it is worth noting that any violation of an enforcement notice from the Privacy Commissioner can result in criminal prosecution with a maximum penalty upon first conviction of a $50,000 fine and two years’ imprisonment. Ms Chung also says her office will consider examining other credit reference systems for similar possible violations. Industry operators are advised to take note.

Claire Chow is an Associate with BC&C, having joined the firm in 2019. She covers a broad range of practice areas including Civil and Commercial Litigation, and Judicial Review. She can be contacted at Claire@boasecohencollins.com.