Privacy issues for e-shoppers

Eunice Lam

Consumers who shop on Hong Kong's popular e-commerce platforms could have their privacy infringed by firms, authorities warned yesterday.

The Office of the Privacy Commissioner for Personal Data reviewed the privacy settings of the 10 most commonly used shopping platforms - Taobo, HKTVmall, Carousell, eBay, BKmall, Fortress, JD.com, PlayStation App, Price.com.hk and Samsung - and found all collected personal data and passed it to third parties.

In fact, all 10 stated they would pass data to third parties such as business partners, subsidiaries, related firms and advertising agencies.

They also formulated privacy policies that state they collect between 12 and 23 types of personal data.

All the platforms tracked users' activities, including location information, browsing history, transaction records and device information.

Most online shopping platforms accept payment through third-party payment platforms.

But Privacy Commissioner for Personal Data Ada Chung Lai-ling said users must further provide information including addresses.

Users of BKmall, Carousell, Fortress and Samsung can choose during the registration process to indicate whether they will accept advertising or promotional messages.

Although eBay, HKTVmall, PlayStation and Price.com.hk provide such options, the default setting is "agreed," while Taobao users are allowed to activate or deactivate "personalized recommendations."

JD.com does not provide an option during registration or display any message seeking consent from users to circulate their data.

The privacy watchdog also said four platforms did not require registering an account before shopping.

Although most required users to be at least 18, the watchdog found Carousell, Fortress and JD.com did not have any measures in place to prevent underage registration.

That was illustrated by the commission creating an account and filling in a date of birth of someone who would be 13.

PlayStation and Samsung collect users' dates of birth to verify they are over 18.

All 10 allowed users to delete accounts, while some provided users with clearer means for account deletion.

The Office of the Privacy Commissioner issued the report to the 10 online shopping platforms and provided six recommendations to their operators.

It urged the platforms to allow users to shop as guests and only collect the personal information needed to process transactions while explaining the reason for tracking and allowing them to stop that process.

And the platforms should ensure the reliability of third-party service providers in terms of privacy protection and information security along with providing more privacy setting options, including registration-free login methods, preferences for receiving various messages, user tracking and a convenient option to delete.

Acting chief personal data officer Brad Kwok Ching-hei said: "We recommend operators of online shopping platforms and other users of private information to appoint a data protection officer and establish a personal data privacy management program."

eunice.lam@singtaonewscorp.com