LCQ7: Personal data being used fraudulently by others for loan applications
***************************************************************

     Following is a question by the Hon Paul Tse and a written reply by the Secretary for Financial Services and the Treasury, Mr James Lau, in the Legislative Council today (November 8):

Question:

     It has been reported that the personal data of a member of the public had been used fraudulently by others, resulting in his being deemed as a loan referee by finance companies without his knowledge.  Subsequently, the victim received within the same period of time telephone calls and short messages from 47 finance companies urging him, in an intimidating manner, to repay loans on behalf of the borrower(s), causing him and his family members to live in a constant state of anxiety.  The victim sought assistance from the Police and the Office of the Privacy Commissioner for Personal Data (OPCPD) but was refused.  In this connection, will the Government inform this Council:

(1) whether it has gained an understanding of the circumstances leading to the incident in which the aforesaid victim was urged to repay loans by 47 finance companies within the same period of time;

(2) as I understand that finance companies have an obligation to verify, before approving loans, that the data subjects are aware of and have given consent to the use of their personal data for loan applications, whether OPCPD has assessed if the finance companies involved in the aforesaid case have contravened the requirements under the Personal Data (Privacy) Ordinance (Cap. 486);

(3) of the reasons why the Police and OPCPD refused to accept the victim’s complaint; the government department or bureau from which the victim may seek assistance; whether it will review Cap. 486 to see if there are loopholes and, if so, plug such loopholes to prevent the recurrence of incidents in which the personal data of innocent members of the public are used fraudulently by others, resulting in their being deemed by finance companies as loan referees without their knowledge; and

(4) given that the debt collection activities of and collection of personal data (including personal data of referees) by licensed money lenders are regulated by the licensing conditions imposed by the licensing court on licensed money lenders pursuant to the Money Lenders Ordinance (Cap. 163), which include prohibiting a money lender and his debt collectors from recovering debts from anyone except the debtor, or from harassing anyone while trying to locate the whereabouts of the debtor, and that if a licensed money lender is in breach of any licensing condition, it may constitute a criminal offence and his licence may be revoked, whether the relevant law enforcement departments have assessed if the aforesaid finance companies have breached the Ordinance and the licensing conditions?

Reply:

President,

     The Government attaches great importance to protecting the personal data of the public.  We note that recently, a member of the public alleged that his personal data had been used fraudulently by others, resulting in his being deemed as a loan referee without his knowledge. 

     In consultation with the Constitutional and Mainland Affairs Bureau and the Security Bureau, our consolidated reply to the question raised by Hon Paul Tse is set out below:

(1) to (3) According to the Money Lenders Ordinance (Cap. 163), all licensed money lenders must carry on money lending business in accordance with the conditions imposed by the licensing court on their licences.  Since December 1, 2016, the licensing court has imposed an additional licensing condition on all money lender licences in order to enhance protection on personal data.  The additional licensing condition states that all money lenders are required to take steps to ensure that when collecting or receiving personal data from another person, the money lender will not take part in any unlawful disclosure or use of personal data.  For example, if a money lender wants to use personal data provided by another person for the purpose of the money lending business, the money lender must obtain written confirmation from the data provider that such provision of personal data for the use of the money lender is not in contravention of the provisions in the Personal Data (Privacy) Ordinance (Cap. 486).  A money lender is also required to keep records that show his compliance with the relevant licensing condition and the provisions of the Personal Data (Privacy) Ordinance.  We are currently conducting a review on the effectiveness of the additional licensing conditions.  We will consider the need to introduce more stringent requirements so as to further enhance the protection of personal data.

     If a member of the public suspects that his personal data privacy has been infringed upon and can provide prima facie evidence, he may lodge a complaint to the Office of the Privacy Commissioner for Personal Data (PCPD).  Upon receipt of the complaint, the PCPD will contact the complainee for follow-up, and decide on the merits of the case if investigation should be conducted for ascertaining whether the complainant has contravened the requirements of the Personal Data (Privacy) Ordinance.  If the incident involves criminal offences (e.g. fraud, access to computer with dishonest intent, repeated nuisance, and even intimidation, etc.), the PCPD will refer the case to the Police for criminal investigation. 

     In general, money lenders should collect the personal data of loan referees in a lawful and fair manner, and for a purpose directly related to their functions or activities.  If money lenders collect via borrowers the personal data of loan referees for the purpose of seeking reference in relation to the loan applications, such collection of personal data is related to their functions and activities, and hence is not in breach of the requirements of the Personal Data (Privacy) Ordinance.  

     According to the Constitutional and Mainland Affairs Bureau, the PCPD has not received any complaint or enquiry in relation to a member of the public alleging his/her personal data being used for the purpose of serving as loan referees without his/her consent, and subsequently being requested for loan repayment by 47 money lenders.  On the other hand, according to the records of the PCPD, from July to September 2017, the PCPD received three telephone enquiries in relation to data subjects' personal data being used for the purpose of serving as loan referees without their consent.  The subjects involved did not request follow-up action after immediate response was made to their enquiries by the PCPD.  In October 2017, the PCPD received a complaint in relation to a data subject's personal data being used for the purpose of serving as loan referee without his/her consent.  The PCPD is following-up on this case. 

     According to the Security Bureau, a member of the public may make a report to the Police if he suspects that his personal data have been used fraudulently to render him/her a loan referee, or if any money lender is suspected to have breached the licensing conditions.  The Police will conduct investigation and follow-up having regard to the circumstances of the case.
 
(4) One of the licensing conditions on money lender licences prohibit the money lender and his debt collectors from attempting to recover debts directly or indirectly from anyone other than the debtor, or harassing anyone while trying to locate the whereabouts of the debtor or adopting illegal or improper debt collection practices. 

     Upon receipt of a report on any money lending business (including debt collection) suspected to be operating using unscrupulous practices or in breach of licensing conditions, the Police Licensing Office will conduct investigation and consider applying to the licensing court for revoking or suspending the money lender’s licence concerned, or consider raising objection to the licensing court when it examines the licence renewal application of the money lender concerned.  The licensing court will take into account the information and justifications provided by the Police and decide whether to revoke, suspend or renew the licence after hearing the case. 

     Should the case involves any act with criminal elements (such as intimidation and criminal damage, etc.), the Police will refer it to the relevant crime formation for rigorous investigation and initiate prosecution against the suspected offenders where there is sufficient evidence.  As for other debt collection cases with no criminal elements (such as harassment by telephone calls or visits, etc.), the Police will, depending on the industry involved, communicate and co-ordinate their efforts with relevant regulatory authorities when necessary.  If these cases show signs of worsening, e.g. involvement of criminal elements, the Police will refer them to crime formations for follow-up.

Ends/Wednesday, November 8, 2017
Issued at HKT 15:55

NNNN