Consumers combat cold-callers as law strengthens privacy protection
By Viola Yeh & Yannie Mak
There can be few adults in Hong Kong who have not received unwanted direct marketing ads in their letter boxes and email inboxes, or received cold calls from companies they have never heard of, selling services they are not interested in. Often, we wonder how they got our addresses and phone numbers.
Concern over personal data reached new heights in 2010 when, after months of denial, Octopus Cards Limited finally admitted it had sold the personal data of two million Octopus Card holders to third parties, for a total of more than HK$44 million. This information included their names, telephone numbers, gender, identity card numbers and even Octopus Card purchase histories.
In the wake of the fiasco, the Privacy Commissioner on Personal Data (PCPD) issued a set of guidelines on direct marketing practices. But they were just that, guidelines lacking teeth. Those teeth have now finally arrived after the Legislative Council passed a set of amendments in July that will tighten restrictions on the use and transfer of personal data, impose strict regulations on direct marketing, introduce heftier fines for violations and make it easier for consumers to take legal action against those who misuse their personal information.
The amended ordinance creates a new offence of disclosure of personal data obtained without consent. Data users – organisations that collect data from customers and other individuals – are required to notify consumers about what their information will be used for and get their written consent before it can be used for direct marketing. Likewise, if the user wishes to transfer that data to any third party for other marketing uses.
If the data user discloses any personal data obtained without a person’s consent in order to gain benefit, they face a maximum fine of HK$1 million and a five-year jail term.
The changes also mean the PCPD will have greater powers to enforce the provisions and provide legal assistance to people whose data has been misused. This means people can pursue compensation claims without being deterred by enormous legal costs or necessarily going to court. The first phase of the ordinance came into effect in October, and the other provisions that include those related to direct marketing are expected to be implemented early next year.
A spokesman for the PCPD said the amendments were necessary because, “the collection and use of personal data in this era of ‘big data’ can create great economic and societal value. But they also pose immense risks to privacy and raise serious concerns about the protection of personal data.”
The world of data looked very different when the Personal Data Ordinance was first implemented in 1996. Technological advances since then have allowed personal data to be collected, stored, analysed, copied and distributed electronically with phenomenal ease and in sophisticated ways. This means data breaches, identity thefts and various forms of misuse of personal data are common occurrences.
One of the most common forms can be seen in cold calling. The word “cold” means that the person receiving the call is not expecting a call or has not specifically asked to be contacted by a salesperson. Often, the salesperson is able to address the call receiver by their family name, which begs the question of where they got the information from.
Fankie Lee Sui-fan, a year-one student in the Chinese University of Hong Kong, had a summer job working for a telemarketer this summer. Her job was to make cold calls and promote beauty services or education courses, such as associate degree and top-up degree programmes. She also promoted investment talks.
Lee says she was assigned telephone numbers obtained through two methods. In the first one, the company gave her a list with phone numbers only and without any personal information. She would have to address the receiver as Mister or Miss depending on what their voice indicated.
A second way the company obtained telephone numbers was to pay their staff to hand in telephone lists. The list should include phone numbers and at least the family names, and gender of the receiver. “[The company] has a huge sales force; when they give out a list of phone numbers, they will get monetary reward,” says Lee. She says a list with 50 contacts was worth about HK$30 to HK$40.
Although she says she never handed in a list, she believes those that she was given probably contained the names and numbers of the friends and relatives of other staff members.
Lee did not enjoy her experience of being a cold call salesperson. The people on the other end were usually annoyed by the calls. People hung up on her and even scolded her. Since the job was neither enjoyable nor well-paid, she quit after a month. “When I was interviewed for the job, I was told that I would always be rejected, and they asked if I could bear it or not.”
Consumers do have some tools with which to fight cold calls. Various smartphone applications can either block the calls or tell receivers not to answer the call. “Small Bear” for Android phones and “Callers” for the iPhone are just two examples. The apps get their data from a website called “HKJunkCall.com”.
HKJunkCall.com, is the brainchild of William Wu Man-hon who thinks cold calls present a serious problem in Hong Kong.
Wu started getting cold calls in early 2008, sometimes he got more than 10 a day. As an IT support assistant, he knew that a simple computer could be easily used to generate those disturbing calls. So he jotted down the numbers. At first, he kept updating the “Black List of Advertising Calls” on some internet forums. But the forums got complaints and the posts were deleted. So, in 2009. Wu set up first a Facebook group and then a website to post numbers.
People who are interested in writing applications for smartphone users to block cold calls from unknown companies contact him for the data of blacklisted phone numbers. Currently, there are seven applications using his information.
Despite the demand and interest in Wu’s service, he insists on maintaining the website for free, working on it for about half an hour every day. He is dedicated to eliminating the disturbance of cold calls because he believes, “phone calls can involve the selling of personal information, I think it is immoral.”
Wu knows there is a market for personal data because he has received emails asking companies to sell customers’ personal data. He gets these emails because he uses a business email address to register for various services. He shows Varsity one email where businesses are told that a set of personal data, including the last name, telephone number and the range of income of an individual can be sold at HK$1 to HK$5 each.
Wu suspects employees are sometimes unable to resist the temptation of selling personal data to make quick money, especially when they are in financial need.
According to Wu, cold calls may involve the selling of personal data and excessive collection of personal data. Most of cold callers claim to be staff from banks and beauty centres. Usually they promote personal loan services or slimming programmes. But some can be bogus. For example, callers may pretend they are staff from a well-known bank, and ask for personal information.
Undesirable marketing tactics by cold callers can cause actual loss to careless consumers. One of the cases Wu has come across is a victim of phone fraud who lost more than HK$10,000.
The victim, who only wants to be identified as Ms Chang, got a call from a beauty centre, asking for a “Miss Tsang” at the end of July. Chang admits that the use of her name, albeit mispronounced, made her drop her guard.
At first, the salesperson told Chang she had been chosen to be a mystery customer who could try out services at five different beauty centres and then make an evaluation in exchange for big discounts.
Chang was interested in the offer but she needed time to consider. The salesperson piled on the pressure and urged her to register during the phone call, otherwise she would be unable to extend the offer.
During the process of registration, Chang gave the salesperson her credit card number and other personal information including her full name, email and home address. But she had not agreed to make any payment. Later, she was shocked when she found that the company had used her credit card to pay for beauty treatments without her consent. Immediately, she turned to the police for help.
However, the police said since she did not state precisely “I do not join”, her response was ambiguous. They said it would be hard to charge the company.
Chang suspects the company had got her information from somewhere else and without her consent. “I am sure that the person who called was not from an organisation which I’m familiar with, not any beauty centre I have joined because they would know how to pronounce my last name. The salesperson called me Miss Tsang, instead of Miss Chang.”
Chang’s case is now being investigated by the Criminal Investigation Department (CID) and she has only managed to recover 10 per cent of her money at this stage.
Hopefully, after the amendments to the Personal Data (Privacy) Ordinance are fully enacted, such cases will become far less common.
Zhao Yun, an associate professor from the Faculty of Law at The University of Hong Kong, welcomes the changes. “I think the commissioners have more power and authority to investigate cases and also to take some measures…and I think, more importantly, there will be changes about the permission to use your data.”
However, he does think there is a weakness in the amendments in that they do not contain any provisions covering “data processors”, that is third-party companies or individuals who are contracted to collect information by the organisations that will use it. They include people who conduct surveys on the streets.
Grandfathering arrangements also mean that companies do not have to comply with the new direct marketing requirements if they use data that was collected before the provisions came into effect, within certain conditions.
Although the new provisions are a vast improvement, Zhao says consumers should still be aware. For instance, they need to be educated about the powers and duties of privacy commissioners.
They also still have to be very careful to tick the opt-out box when applying for products and services if they are unwilling to disclose their information to third parties or for its use in marketing. It is an important step to indicate their disagreement clearly.
Apart from being more cautious when filling out forms, William Wu Man-hon, the administrator of the HKJunkCall.com, warns people to be extra vigilant when they answer anonymous phone calls. They should never believe in strangers’ claimed identities. “Customers should decide to what extent they would disclose their personal information, it is their responsibility.”
