Code of Practice

Under section 12(1) of the PD(P)O, the Privacy Commissioner may, for the purpose of providing practical guidance in respect of any of the requirements of the PD(P)O, including those of the data protection principles, approve and issue codes of practice. The preparation of such a code may be done by a particular sector or profession or by the Privacy Commissioner. Before approving a code of practice the Privacy Commissioner is required to consult such representative bodies of data users to which the code will apply and such other interested persons as he thinks fit.

Revisions to the Code of Practice on Consumer Credit Data

The 2001-02 annual report drew attention to the fact that the protracted economic downturn in Hong Kong had had a serious impact upon the financial services sector and the market for consumer credit in particular. Over the course of the year the number of consumers reporting delinquent on credit card accounts and in default on personal loans has risen appreciably.

In seeking to explain the deteriorating situation credit providers have maintained that the core of the problem lay with their inability to assess the creditworthiness of borrowers. Currently credit providers can share negative credit information of their customers when processing credit applications. The industry argued that this data was insufficient to enable them to obtain an accurate picture of the true financial position of the borrower. They called for a greater sharing of consumer credit data to include positive data via the credit reference agency. The view taken was that the effective utilization of shared information could facilitate better credit risk management and overcome the problem of credit providers having to lend blind.

The industry's proposal, if implemented, amounts to a relaxation of the provisions of the current Code of Practice on Consumer Credit Data. Subsequent to the Roundtable Discussion held among industry representatives and government officials in January 2002, the PCPD established a working group to conduct an in-depth study of the privacy-related issues arising from the sharing of positive credit data. On 28 August 2002, the PCPD issued a consultation document to seek public views on a set of proposed provisions on consumer credit data protection. In essence those provisions were designed to make the market less opaque by permitting the sharing of limited positive credit data that would be subject to specific privacy measures and controls designed to safeguard the interests of consumers.

The consultation exercise ended on 25 October 2002. A total of 282 responses were received from various sections of the community. The consultation results reflected a broad public consensus that the rising trend in personal bankruptcy and consumer debt was a matter of major concern to the community. If not addressed, the bankruptcy problems may lead to a loss of consumer confidence in the market and the economy as a whole. Having carefully considered the various views and suggestions, the PCPD released a consultation report on 23 January 2003 recommending revisions to the Code to give effect to a new regulatory framework on consumer credit data sharing.

There are many factors contributing to the increase in consumer debt and bankruptcy, which have had a significant social economic impact. The PCPD do not regard the proposal for greater sharing of credit data as a cure for this problem but believe that credit information transparency benefits both credit providers and borrowers in facilitating an efficient credit environment and promoting a responsible lending and borrowing relationship. In making amendments to the Code the PCPD has endeavoured to strike a balance between the public interest and the personal data privacy rights of the individual. Any solution that strives to attain this goal is unlikely to satisfy the demands of all sectors of the community. Nonetheless, given the gravity of the situation the PCPD remains of the view that a considered response to a serious economic development was justified and that the privacy safeguards to be implemented would provide an equitable solution for the parties involved. The checks and balances in the system by way of privacy safeguards and independent compliance auditing were expressly designed to ensure that the personal data privacy rights of the community would not been diminished.

The revised Code has since been gazetted in May and took effect from 2 June 2003.