M+ visit demands sparks privacy concerns

Top News | Maisy Mok 11 Nov 2021

Maisy Mok

A museum pass holder has raised privacy concerns over the registration procedure for visitors to the new M+ museum in West Kowloon that opens tomorrow, which collects personal details including one's full passport name, phone number and e-mail address.

Regina Ho, a retiree in her 50s, frequently visits museums and is a holder of a museum pass issued by the Leisure and Cultural Services Department.

Ho had wished to visit M+ in West Kowloon Cultural District next Tuesday, but said the collection of "excessive" amounts of personal information eventually deterred her from booking a free ticket.

The booking system requires visitors to provide their full names as shown on their passport, the country or region of the travel document, phone number, e-mail address and their title, which indicates their gender or marital status.

"I feel like it's quite an invasion of my privacy," Ho said, adding that at the Hong Kong Museum of Art, where admission is also free, she was only required to scan the LeaveHomeSafe mobile app when she visited on Friday.

She also said the government's annual museum pass only required a full name and telephone number when she applied.

According to the M+ booking site, powered by booking platform Klook, the information required is part of the "contact information" the museum uses to notify registrants of any changes to their booking.

The website also states that the museum uses the personal details to offer event information about M+ or West Kowloon Cultural District should the visitor opt for the service.

The Office of the Privacy Commissioner for Personal Data said it would not comment on individual cases.

The law states that data collected must be "necessary, adequate but not excessive in relation to the purpose of collection," it said.

Wong Ho-wa of Internet Society Hong Kong's open data working group said requiring a full name, e-mail address and phone number is understandable to prevent people from purchasing multiple tickets. However, passport-related information is sensitive.

Wong advised the public to find out whether the information given would be deleted at some point and whether the relevant companies would give the information to a third party.

Francis Fong Po-kiu, honorary president of the Hong Kong Information Technology Federation, said: "Normally if the system is not hacked, data [collected] by the West Kowloon Cultural District Authority should be fine. Also they didn't collect Hong Kong identity cards [or] passport [numbers] and addresses, so exposure is minimum."

Based on the booking website, registrants must agree to M+'s reservation terms and conditions, and consent to the use of information in accordance with a privacy policy and personal information collection statement.

M+'s privacy policy statement states that after determining the appropriate retention period by taking into account the amount, nature and sensitivity of the personal data, it will retain personal data for "as long as is reasonably necessary to fulfill the purposes we collected it for."

The Standard attempted to register for a ticket and received two confirmation e-mails afterward. One attached a document that shows a QR code, voucher number and booking number.

The document instructed registrants they could enter M+ by presenting the e-mail confirmation.

A WKCDA spokesman said the personal information collected is for booking purposes, including confirming the booking information and informing visitors in case of any changes like bad weather.

The spokesman said: "The current registration platform is the first release of the booking system based on the existing platform of the operator [Klook]. In light of the feedback received, we will review the settings in conjunction with the operator and introduce enhancements as appropriate."

M+ has advised the public to make online reservations ahead of visiting, as most slots for the opening weekend are fully booked and waiting time for walk-in entries may be extended.

Search Archive

Advanced Search
December 2021

Today's Standard