This document discusses personal data privacy on the internet. It summarizes a survey of Hong Kong-based websites that found most were not complying with the territory's data privacy law. Specifically, over 90% did not display privacy policy statements, and nearly 70% lacked notices about how personal information would be collected and used. The document outlines Hong Kong's data privacy principles and guidelines being issued to help websites better protect users' personal information online.

1. Personal Data Privacy and The Internet
by
Stephen Lau
Privacy Commissioner for Personal Data, Hong Kong SAR
at the
Joint Conference of the OECD, HCOPIL, ICC
“Building Trust in the Online Environment:
Business to Consumer Dispute Resolution”
The Crowne Plaza Promenade Hotel
The Hague, The Netherlands
11 - 12 December 2000
1

2. Electronic Commerce
Consumer TRUST & CONFIDENCE
Identity of suppliers ?
Integrity of information ?
Electronic contract ?
Payment reliability ?
Errors/frauds ?
DATA PRIVACY ?
2

3. Forrester Research, October 1999, US
• 90% of online consumers want to have control over
how their personal data is used once it has been
collected
• two out of three people say that they have reservations
about giving out personal information online
• consumers who have moderate privacy concerns spend
21% less online than those who have less than
moderate concerns
3

4. 4

5. 2000 Community Opinion Survey
Importance of social policy issues in Hong Kong .
8.75
7.58
7.40
7.37 7.25
6.44
7.64
7.95
6.80
7.46
7.63
8.42
6.66
8.30
6.79
7.26
7.63
8.10
8.21
0
1
2
3
4
5
6
7
8
9
10
air pollution unemployment privacy food hygiene health services care for the
elderly
sex
discrimination
Mean
value
of
responses
1997
1998
1999
2000
0 = not important at all
10 = very important
5

6. The basic premise is
“What is illegal off-line is
also illegal on-line”
6

7. Personal Data (Privacy) Ordinance
Data Protection Principles
Principle 1 - Purpose and manner of collection -
• this provides for the lawful and fair collection of personal
data and sets out the information a data user must give to a
data subject when collecting personal data from the subject.
Principle 2 - Accuracy and duration of retention -
• this provides that personal data should be accurate, up-to-
date and kept no longer than necessary.
7

8. Personal Data (Privacy) Ordinance
Data Protection Principles
Principle 3 - Use of personal data -
• this provides that unless the data subject gives consent
otherwise personal data should be used for the purposes for
which they were collected or a directly related purpose.
Principle 4 - Security of personal data -
• this requires appropriate security measures to be applied to
personal data (including data in a form in which access to
or processing of the data is not practicable).
8

9. Personal Data (Privacy) Ordinance
Data Protection Principles
Principle 5 - Information to be generally available -
• this provides for openness by data users about the kinds of
personal data they hold and the main purposes for which
personal data are used.
Principle 6 - Access to personal data -
• this provides for data subjects to have rights of access to
and correction of their personal data.
9

10. Data Privacy Issues on Internet
• no personal information collection (PIC) statement with on-
line data collection by websites
• no display of data privacy policy statement with websites
• data collection without consent (e-mail address, cookies,
etc.)
• unfair collection (e.g. from children)
• interception of data during transmission
• use of data different from original purpose of collection
• security of data held in websites
• spamming
• identity theft
10

11. Sample Survey of Hong Kong -
Based Web Sites
• Conducted between July to October 1998
• Visited 531 sites from both public and
private sectors
11

12. Objectives
• To assess the extent to which Hong Kong-based web sites
are operated in a manner that meets:
- the requirements of the Personal Data (Privacy)
Ordinance
- standards of good and reasonable personal information
handling
12

13. Provision of Personal Information
Collection (PIC) Statement
339 sites had
personal data
collection forms
231 forms
(68.1%)
108 forms
(31.9%)
With PIC
Statement
Without
PIC
Statement
13

14. Provision of Privacy Policy Statement
Only 21 sites had
Privacy Policy
Statements
318 sites
(93.8%)
21 sites
(6.2%)
With
Privacy
Policy
Statement
Without
Privacy
Policy
Statement
14

15. Results of Compliance Check Exercise
• 59 sites (25%) of 236 sites which have online personal data
collection form displayed a PPS
1999 Results
75%
without
PPS
25%
with PPS
1998 Results
6.2%
with PPS
93.8%
without
PPS
15

16. Results of Compliance Check Exercise
• 220 sites (93%) of the 236 sites which have online personal
data collection forms displayed a PICS
• Formal investigations being carried out into 16 sites (7%)
1999 Results
93%
7%
With PICS
Without PICS
236 sites have
online personal
data collection
forms
1998 Results
68%
32%
With
PICS
Without
PICS
339 sites had
online personal
data collection
forms
16

17. Guidelines on the Protection of
Personal Data Privacy on the Internet
• “Internet Surfing with Privacy in Mind” - A Guide
for Individual Net users
• “Personal Data Privacy and the Internet” - A Guide
for Data Users
• “Preparing On-line - Personal Information
Collection Statements and Privacy Policy
Statements”
17

18. Launching in 2001
A Series on “E-Privacy”
18

19. Privacy Commissioner for Personal Data
Hong Kong
Website: http://www.pco.org.hk
Hotline: (852) 2827 2827
`19