- Softmedia explained that the process of transforming a HKID number into a code is irreversible. The actual HKID number of a borrower cannot be viewed in the TE Credit Reference System and the database only contains a set of codes with the corresponding credit data. Thus, Softmedia considered that the TE Credit Reference System does not contain any "personal data" of the borrowers.
- The Commissioner disagreed with Softmedia's view that it is not holding any personal data. In the Commissioner's opinion, although Softmedia stores HKID numbers in the form of codes, based on the unique and invariable characteristics of an HKID number and the fact that the same code would always be generated after inputting the same HKID number into the TE Credit Reference System, the code concerned is an identifier assigned to a borrower by Softmedia for its operation. This identifier can uniquely identify the borrower, thus constitutes a "personal identifier"[1] and also "data"[2] as defined under the Ordinance.
- From another perspective, Softmedia stated that the purpose of establishing the TE Credit Reference System is to provide reference data by way of a platform to money lending companies, so that they can make loan assessments based on the credit data of borrowers before deciding whether to approve or reject their loan applications. If the TE Credit Reference System did not hold personal data, the money lending companies could not achieve such purpose of making reference to the credit records of individual borrowers in assessing their loan applications.
- With regard to the subject complaint, the money lending company acquainted with the complainant was able to identify the complainant by combining data from the TE Credit Reference System and the Loan Management System, and thereby discovered that his credit data had been accessed many times. This demonstrates how it is practicable for the money lending companies to directly or indirectly ascertain the identity of a data subject from the data mentioned above, which therefore constitutes "personal data" under the Ordinance.
- ↑ Under Section 2(1) of the Ordinance, "personal identifier" means an identifier (a) that is assigned to an individual by a data user for the purpose of the operations of the user; and (b) that uniquely identifies that individual in relation to the data user, but does not include an individual's name used to identify that individual.
- ↑ Under Section 2(1) of the Ordinance, "data" means any representation of information (including an expression of opinion) in any document, and includes a personal identifier.
4
