Amendments to Notice to Customers and other individuals relating to the Personal Data (Privacy) Ordinance (the “Ordinance”) and the Code of Practice on Consumer Credit Data (“Notice”)
With effective from 28 November 2022, the Notice of the Company will be updated. The updated Notice explains how we collect, use, process and share your personal data as part of our services to you. We are required to handle and use your personal data in accordance with the Personal Data (Privacy) Ordinance (the “PDPO”).
The updated Notice includes changes that relate to an important development in Hong Kong:
Multiple Credit Reference Agencies Model
The Multiple Credit Reference Agencies (“MCRA”) model is an important new initiative developed by the Hong Kong Association of Banks, the DTC Association and the Hong Kong S.A.R. Licensed Money Lenders Association.
When you apply for a mortgage, loan or other credit product or service, the lender will seek a credit reference report about you from a consumer credit reference agency (“CRA”). CRAs collect information about your past and present borrowing from various creditors who have made loans to you, and then provide this information to potential new lenders to help them assess your creditworthiness. At present, there is only one CRA in Hong Kong. The MCRA model enables lenders to share and use consumer credit data through more than one CRA.
Selected CRAs will not be allowed to transfer credit data outside Hong Kong without customer’s consent under the requirements of the MCRA model.
The MCRA model will be launched by the end of 2022.
Summary of Major Changes in the Updated Notice
We have set out an overview of key changes in the updated Notice below, which includes changes concerning the collection and disclosure of consumer credit data under the MCRA model:
- Paragraph (c) – Collection of Personal Data from CRAs
Paragraph (c) of the updated Notice refers to our receipt of personal data from CRAs as part of their consumer credit reporting services.
- Paragraph (e)(iv) – Disclosure of Data to Platform Operator
We have made it clear in paragraph (e)(iv) that as part of the MCRA model, your consumer credit data may be transferred to the operator of the centralized platform forming part of MCRA.
- Paragraphs (f), (h) to (j), (l) and (m) – references to CRAs in plural (Paragraphs (f), (h) to (j) and (l) are only applicable to the English version of the updated Notice)
Paragraphs (f), (h) to (j), (l) and (m) of the updated Notice refer to CRAs in plural, reflecting that transfers of your consumer credit data will be made to multiple CRAs under the MCRA model instead of just to one CRA.
We enclose herewith an updated version of the Notice. Please review these changes carefully and feel free to contact us if you have any questions.
PrimeCredit Limited (“PCL”) Notice to Customers and other individuals relating to the Personal Data (Privacy) Ordinance (the “Ordinance”) and the Code of Practice on Consumer Credit Data
- From time to time, it is necessary for data subjects to supply PCL with data in connection with the following matters such as:
-
- the opening or operation of accounts;
- the establishment or maintenance of facilities; and/or
- the establishment or operation or provision of products or services offered by or through PCL (which include credit facilities, credit cards, financial and/or insurance as well as products and services relating to these);
(collectively, Facilities, Products and Services), and/or
- the receipt of supplies and services to PCL.
- Failure to supply such data may result in PCL being unable to establish, maintain or provide Facilities, Products and Services to data subjects.
- It is also the case that data are collected by PCL from data subjects transacting with or through PCL in the ordinary course of PCL’s business, for example, when data subjects write cheques or deposit money or effect transactions through credit cards. PCL will also collect data relating to data subjects from the credit reference agencies approved for participation in the Multiple Credit Reference Agencies Model (hereinafter referred to as “credit reference agencies”).
- Data relating to a data subject may be used for any one or more of the following purposes:
- processing applications from the data subject (including assessing the merits and/or suitability of the data subject’s application(s)) for the establishment of Facilities, Products and Services;
- operating, maintaining and providing Facilities, Products and Services to the data subject;
- conducting credit checks on the data subject (whether in respect of an application for Facilities, Products and Services or during regular or special review which normally will take place once or more each year);
- creating and maintaining PCL’s credit scoring models;
- assisting other financial institutions in Hong Kong approved for participation in the Multiple Credit Reference Agencies Model to conduct credit checks and collect debts;
- maintaining credit history of the data subject for present and future reference;
- ensuring ongoing credit worthiness of the data subject;
- designing credit facilities, credit cards, financial and insurance services or related products for the data subject’s use;
- marketing services, products and other subjects (please see further details in paragraph (g) below);
- determining the amounts of indebtedness owed to or by data subjects;
- enforcement of data subject’s obligations, including without limitation the collection of amounts outstanding from data subject and those providing security for data subjects‘ obligations;
- meeting or complying with any obligations, requirements or arrangements for disclosing and using data that apply to PCL or that it is expected to comply according to:
- any law or regulation binding on or applying to it within or outside the Hong Kong Special Administrative Region existing currently and in the future;
- any guidelines or guidance given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers within or outside the Hong Kong Special Administrative Region existing currently and in the future;
- any present or future contractual or other commitment with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers that is assumed by or imposed on PCL by reason of its financial, commercial, business or other interests or activities in or related to the jurisdiction of the relevant local or foreign legal, regulatory, governmental, tax, law enforcement or other authority, or self-regulatory or industry bodies or associations;
- meeting or complying with any obligations, requirements, policies, procedures, measures or arrangements for sharing data and information within PCL and/or any other use of data and information in accordance with any programmes for compliance with sanctions or prevention or detection of money laundering, terrorist financing or other unlawful activities;
- enabling an actual or potential assignee of PCL, or participant or sub-participant of PCL’s rights in respect of the data subject, to evaluate the transaction intended to be the subject of the assignment, participation or sub-participation; and/or
- any other purposes relating to the purposes listed above.
- Data held by PCL relating to a data subject will be kept confidential but PCL may provide, transfer or disclose such data or information to any one or more of the following parties (whether within or outside the Hong Kong Special Administrative Region) for the purposes set out in paragraph (d) above:
- any agent, contractor or third party service provider who provides administrative, telecommunications, computer, payment or other services to PCL in connection with the establishment, operation, maintance or provision of Facilities, Products and Services;
- any other person under a duty of confidentiality to PCL;
- the drawee bank providing a copy of a paid cheque (which may contain information about the payee) to the drawer;
- credit reference agencies (including the operator of any centralized database used by the credit reference agencies), and, in the event of default, to debt collection agencies or solicitor firms;
- any person or entity to whom PCL is under an obligation or otherwise required to make disclosure under the requirements of any law or regulation binding on or applying to PCL, or any disclosure under and for the purposes of any guidelines, guidance, directives, rules, codes, circulars or other similar documents given or issued by any legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers with which PCL is expected to comply, or any disclosure pursuant to any contractual or other commitment of PCL with local or foreign legal, regulatory, governmental, tax, law enforcement or other authorities, or self-regulatory or industry bodies or associations of financial services providers, all of which may be within or outside the Hong Kong Special Administrative Region and may be existing currently and in the future;
- any financial institution and merchant acquiring company with which a data subject has or proposes to have dealings;
- any actual or proposed assignee of PCL or participant or sub-participant or transferee of PCL’s rights in respect of the data subject;
- any party giving or proposing to give a guarantee or third party security to guarantee or secure the data subject’s obligations; and/or
- (1) third party financial institutions, insurers, credit card companies and related services providers;
(2) third party reward, loyalty, co-branding and privileges programme providers;
(3) co-branding partners of PCL (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be);
(4) charitable or non-profit making organisations; and
(5) external service providers (including but not limited to mailing houses, telecommunication companies, telemarketing and direct sales agents, call centres, data processing companies and information technology companies) that PCL engages for the purposes set out in paragraph (d)(ix) above.
Such information may be transferred to a place outside the Hong Kong Special Administrative Region.
- (i) With respect to data in connection with mortgages applied by a data subject (in any capacity) on or after 1 April 2011, the following data relating to the data subject (including any updated data of any of the following data from time to time) may be provided by PCL, on its own behalf and/or as agent, to the credit reference agencies:
- full name;
- capacity in respect of each mortgage (as borrower, mortgagor or guarantor, and whether in the data subject’s sole name or in joint names with others);
- Hong Kong Identity Card Number or travel document number;
- date of birth;
- correspondence address;
- mortgage account number in respect of each mortgage;
- type of the facility in respect of each mortgage;
- mortgage account status in respect of each mortgage (e.g., active, closed, write-off (other than due to a bankruptcy order), write-off due to a bankruptcy order); and
- if any, mortgage account closed date in respect of each mortgage.
(ii) The credit reference agencies will use the above data supplied by PCL for the purposes of compiling a count of the number of mortgages from time to time held by the data subject with credit providers in the Hong Kong Special Administrative Region, as borrower, mortgagor or guarantor respectively and whether in the data subject’s sole name or in joint names with others, for sharing in the consumer credit databases of the credit reference agencies by credit providers (subject to the requirements of the Code of Practice on Consumer Credit Data approved and issued under the Ordinance).
(iii) PCL may from time to time access the mortgage count held by the credit reference agencies in the course of:
- considering mortgage loan application(s) made by the data subject (in any capacity);
- reviewing any credit facility (including mortgage loan) granted or to be granted to the data subject (in any capacity) which is in default for a period of more than 60 days with a view to putting in place any debt restructuring, rescheduling or other modification of the terms of such credit facility by PCL;
- reviewing any credit facility (including mortgage loan) granted or to be granted to the data subject (in any capacity), where there is in place any debt restructuring, rescheduling or other modification of the terms of such credit facility between PCL and the data subject consequent upon a default in the repayment of such credit facility for implementing such arrangement, and/or
- reviewing any credit facility (including mortgage loan) granted or to be granted to the data subject (in any capacity), with a view to putting in place any debt restructuring, rescheduling or other modification of the terms of any credit facility initiated by the request of the data subject.
(iv) PCL may from time to time access the mortgage count held by the credit reference agencies in the course of (after 31 March 2013):
- reviewing and renewing mortgage loans granted or to be granted to the data subject (in any capacity); and/or
- considering the application for credit facility (other than mortgage loan) by the data subject (in any capacity other than mortgagor) and/or reviewing or renewing any facility (other than mortgage loan) granted or to be granted to the data subject (in any capacity other than mortgagor), in each case where such facility is in an amount not less than such level or to be determined by a mechanism as prescribed or approved by the Privacy Commissioner for Personal Data from time to time.
- USE OF DATA IN DIRECT MARKETING
PCL intends to use a data subject’s data in direct marketing and PCL requires the data subject’s consent (which includes an indication of no objection) for that purpose. In this connection, please note that:
- the name, contact details, products and services portfolio information, transaction pattern and behaviour, financial background and demographic data of a data subject held by PCL from time to time may be used by PCL in direct marketing;
- the following classes of services, products and subjects may be marketed:
- credit facilities, financial, insurance, credit card and related services and products;
- reward, loyalty or privileges programmes and related services and products;
- services and products offered by PCL’s co-branding partners (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
- donations and contributions for charitable and/or non-profit making purposes;
- the above services, products and subjects may be provided or (in the case of other promotion activities, donations and/or contributions) solicited by PCL and/or:
- third party financial institutions, insurers and credit card companies;
- third party reward, loyalty, co-branding or privileges programme providers;
- co-branding partners of PCL (the names of such co-branding partners can be found in the application form(s) for the relevant services and products, as the case may be); and
- charitable or non-profit making organisations;
- In addition to marketing the above services, products and subjects itself, PCL also intends to provide the data described in paragraph (g)(i) above to all or any of the persons described in paragraph (g)(iii) above for use by them in marketing those services, products and subjects, and PCL requires the data subject’s written consent (which includes an indication of no objection) for that purpose;
- PCL may receive money or other property in return for providing the data to the other persons in paragraph (g)(iv) above and, when requesting the data subject’s consent or no objection as described in paragraph (g)(iv) above, PCL will inform the data subject if it will receive any money or other property in return for providing the data to the other persons.
If a data subject does not wish PCL to use or provide to other persons his/her data for use in direct marketing as described above, the data subject may exercise his/her opt-out right by notifying PCL.
- Under and in accordance with the terms of the Ordinance and the Code of Practice on Consumer Credit Data approved and issued under the Ordinance, any data subject has the right:
- to check whether PCL holds data about him and/or access to such data;
- to require PCL to correct any data relating to him which is inaccurate;
- to ascertain PCL’s policies and procedures in relation to data and to be informed of the kind of personal data held by PCL and/or he/she has access to;
- to be informed on request which items of data are routinely disclosed to credit reference agencies or debt collection agencies, and be provided with further information to enable the making of an access and correction request to the relevant credit reference agency(ies) or debt collection agency(ies); and
- in relation to any account data (including, for the avoidance of doubt, any account repayment data) which has been provided by PCL to a credit reference agency, to instruct PCL, upon termination of the account by full repayment, to make a request to the credit reference agency to delete such account data from its database, as long as the instruction is given within five years of termination and at no time was there any default of payment in relation to the account, lasting in excess of 60 days within five years immediately before account termination. Account repayment data includes amount last due, amount of payment made during the last reporting period (being a period not exceeding 31 days immediately preceding the last contribution of account data by PCL to the credit reference agency), remaining available credit or outstanding balance and default data (being amount past due and number of days past due, date of settlement of amount past due, and date of final settlement of amount in default lasting in excess of 60 days (if any)).
- In the event of any default of payment relating to an account, unless the amount in default is fully repaid or written off (other than due to a bankruptcy order) before the expiry of 60 days from the date such default occurred, the account repayment data (as defined in paragraph (h)(v) above) may be retained by the credit reference agencies until the expiry of five years from the date of final settlement of the amount in default.
- In the event any amount in an account is written-off due to a bankruptcy order being made against a data subject, the account repayment data (as defined in paragraph (h)(v) above) may be retained by the credit reference agencies, regardless of whether the account repayment data reveals any default of payment lasting in excess of 60 days, until the expiry of five years from the date of final settlement of the amount in default or the expiry of five years from the date of discharge from a bankruptcy as notified by the data subject with evidence to the credit reference agency(ies), whichever is earlier.
- In accordance with the terms of the Ordinance, PCL has the right to charge a reasonable fee for the processing of any data access request.
- Without limiting the generality of the foregoing, PCL may from time to time access the personal and account information or records of a data subject held by the credit reference agencies for the purpose of reviewing any of the following matters in relation to the existing credit facilities granted to a data subject or a third party whose obligations are guaranteed by a data subject:
- an increase in the credit amount;
- the curtailing of credit (including the cancellation of credit or a decrease in the credit amount); and
- the putting in place or the implementation of a scheme of arrangement with the data subject or the third party.
- PCL may have obtained a credit report on a data subject from one or more credit reference agency(ies) in considering any application for credit. In the event the data subject wishes to access the credit report, PCL will advise the contact details of the relevant credit reference agency(ies).
- Data of a data subject may be processed, kept, transferred or disclosed in and to any country as PCL or any person who has obtained such data from PCL referred to in (e) above considers appropriate. Such data may also be processed, kept, transferred or disclosed in accordance with the local practices and laws, rules and regulations (including any governmental acts and orders) in such country.
- The person to whom requests for access to data or correction of data held by PCL, or for information regarding PCL’s data policies and practices and kinds of data held by PCL are to be addressed is as follows:
- Data Protection Officer
- PrimeCredit Limited
- P.O. Box 23207, Wanchai Post Office, Hong Kong
- Telephone: 2163 0201
- Fax: 2134 3377
- Nothing in this Notice shall limit the rights of data subjects under the Personal Data (Privacy) Ordinance.
In this notice, unless inconsistent with the context or otherwise specified, the words in italic shall have the following meanings:
account means, for each Facility, Service or Product which PCL may from time to time make available to the data subjects, the account that is, opened and/or maintained in respect of it from time to time.
data subject(s) includes applicants for Facilities, Products and Services, customers, customer’s spouse, security providers, referees, corporate officers and managers, suppliers, agents, contractors, service providers and other contractual counterparties and any third party transacting with or through PCL.
disclose, disclosing or disclosure, in relation to personal data, includes disclose or disclosing information inferred from the data.
in any capacity means whether as a borrower, mortgagor or guarantor and whether in the data subject’s sole name or joint names with others.
mortgage count means the number of mortgage loans held by the data subject (in any capacity) with credit providers in the Hong Kong Special Administrative Region from time to time.
Should there be any inconsistencies between the English and Chinese versions, the English version shall prevail.
November 2022