Portal:Office of the Privacy Commissioner for Personal Data, Hong Kong

“ Data Protection Principle 2 (2) of the Ordinance provides that personal data should not be kept longer than the period that is necessary for the fulfilment of the purpose for which the data are or are to be used. Paragraphs 3.3, 3.3.1 and 3.3.2 of the Code provide that credit reference agencies can only retain account repayment data in their database for five years after the date of final settlement or the date of discharge from bankruptcy, whichever is earlier. Softmedia clearly did not meet the requirements of the Code or implement a policy of credit record deletion after repayments. ”

“ The Commissioner encourages organisations to implement a "Personal Data Privacy Management Programme" [10] through which personal data privacy protection can be incorporated into their data governance responsibilities. They should bear in mind the importance of personal data protection in daily operations and adopt a top-down approach in executing open and transparent information policies and standing instructions, so as to signal their determination in exemplifying good corporate governance. ”

“ The participating money lending companies are only charged when they use the TE Credit Reference System (i.e. a money lending company can gain unlimited access to a borrower's credit data for five days with a payment of $2, and this five-day cycle can be repeated with no limits set in terms of payment or access) . Thus, a money lending company can gain unlimited access to the credit data of a specific borrower as long as it declares that it has obtained authorisation from the borrower and pays the fees. ”