Your favorite platforms are storing personal data

Most of Hong Kong's 10 commonly used social media platforms - including Facebook, Instagram and WhatsApp - collect users' credit card information, age, location, e-mail addresses and phone numbers, the Privacy Commissioner has found.

Facebook, Facebook Messenger and Instagram collect the most of up to 19 types of personal data.

Commissioner Ada Chung Lai-ling warned the information could be used for doxxing, cyberbullying and phishing and advised users to turn off some of the settings and limit the scope of data the platforms can obtain.

"I call for greater vigilance and smart use of social media when users surf or communicate online in order to reduce the risks posed to data privacy," she said.

Chung has sent the report to operators of the platforms to ask them to avoid collecting unnecessary information.

The Office of the Privacy Commissioner of Personal Data rolled out a report yesterday on privacy functions and policies in 10 of the most used social media platforms by users aged between 16 and 64 during the third quarter of 2020.

These also include Line, LinkedIn, Skype, Twitter, WeChat, WhatsApp and YouTube.

Assessed by the amount of data collection, readability of privacy policies, privacy function and social media security, Youtube scored the highest in general while Messenger and Skype scored high in screening users' personal information.

At least 12 to 19 types of personal data have been collected by the platforms, ranging from users' personal information, browsing and interaction activity and transaction record to precise location data, according to the report.

Information data collected over and above were enlisted in privacy policy to be transferred to other subsidiary companies.

Among the 10 platforms, only Skype and YouTube's default privacy systems do not disclose users' age and mobile number while eight other platforms disclose age, location, e-mail address or even personal contact number by default.

All reviewed social media platforms collect users' location data by default.

Users should immediately adjust their privacy settings when setting up an account, the office warned.

Apart from WeChat, all instant messaging applications launched end-to-end encryption message transmission between users. Besides Line, all platforms from the report offer two-factor authentication. The report revealed that users' credit card information was retained by platforms as users undergo transactions through social media platforms.

As LinkedIn, Skype and Youtube redirect users to another payment application when undergoing transactions, the platforms might collect users' transaction records or even credit card information.

bowie.tse@singtaonewscorp.com