Use of Personal Data in Fintech Development

Our Ref.: B1/15C B9/29C 3 May 2019 The Chief Executive All Authorized Institutions Dear Sir/Madam, Use of Personal Data in Fintech Development I am writing to encourage authorized institutions (AIs) to adopt and implement the Ethical Accountability Framework for the collection and use of personal data (the Framework) issued by the Office of the Privacy Commissioner for Personal Data (PCPD). As fintech development in the banking sector gathers pace, AIs will be collecting and using an increasing amount of personal data of customers so as to provide them with tailored financial services. In view of this development, the HKMA, in collaboration with the Hong Kong Association of Banks (HKAB), has been engaging with the PCPD to provide more guidance to AIs on the proper use of personal data in the online environment. Under the auspices of the Banking Made Easy initiative, the HKMA and HKAB jointly organised in April a seminar entitled “Use of Personal Data in the Digital Era”. At the seminar, Mr Stephen Kai-yi Wong, the Privacy Commissioner for Personal Data, outlined the Framework to the industry and shared a number of good practices including the adoption of “privacy by design” and “privacy by default” when developing fintech initiatives. Further, the concept of data ethics and stewardship was introduced, and the “Data Stewardship Accountability, Data Impact Assessments and Oversight Models” (the Models) supporting the Framework were explained. The Models can assist AIs in addressing privacy concerns of customers and enhance their trust in using fintech services. The HKMA supports the concept of data ethics and stewardship in the context of collecting and using personal data. It encourages AIs to adopt the Framework and implement the Models in the development of fintech products and services. Further details about the Framework and the Models, as well as training programmes tailored for the banking sector, can be found on the website of the PCPD.

Should you have any questions about this circular, please feel free to contact Mr Alvin Li on 2878-1458 or Mr Patrick Chang on 2878-8561. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) c.c. The Office of the Privacy Commissioner for Personal Data (Attn: Mr Stephen Wong, Privacy Commissioner for Personal Data Mr Tony Lam, Deputy Privacy Commissioner for Personal Data) The Hong Kong Association of Banks