Every day, millions of Hong Kong residents use the Octopus cashless cards to buy anything from train tickets, groceries, to parking.

Now the CEO of Octopus Holding Ltd., Prudence Chan has resigned. It comes after she was held responsible for selling private data of nearly two million customers to six insurance companies, without their consent.

[Leong Kwok Kuen, Octopus Non-executive Chairman]:
“Regrettably, after recent events, we all understand it would be difficult for Prudence to continue in her role as Chief Executive Officer of Octopus, and therefore the board has accepted her resignation.”

The sale of personal data generated 44 million H.K. dollars, or almost six million U.S. dollars.

At a forum last Sunday, Assistant Professor of Politics and Public Administration at the Chinese University of Hong Kong, Dr. Wilson Wong says the current punishment for privacy breaches is not severe enough for it to be effective.

[Dr Wilson Wong, Assistant Professor, Chinese University of Hong Kong]:

“Recently there’s only been one case of monetary penalty for [privacy infringement], the fine was just a few thousand dollars. But when you think about it, Octopus has sold citizens' private information for $44 million dollars, so a few thousand dollars will not be an effective deterrent."

Law-maker Emily Lau says the Hong Kong administration also needs to be held accountable.

[Emily Lau, Vice-chairperson of Democratic Party]:

“I think the Hong Kong public needs to criticize the Hong Kong government for failing to protect the privacy of the citizens.”

After the privacy debacle, the partly-government owned Octopus says it will delete all non-essential information on customers from its database. It has also pledged to donate the estimated six million dollars it made from selling customer data to a community fund in a bid to regain public trust.