Hong Kong Regulator Investigates Customer Data Handling in Cigna Marketing Arrangement

Regulators are examining a customer information sharing arrangement between insurer Cigna and smart card payment system Octopus used for cross-selling insurance products in Hong Kong, which has raised concerns about personal data privacy protection.

Cigna Worldwide Insurance Hong Kong participates in the Octopus Rewards program, with which customer information is shared to offer special insurance plans, according to Cigna.

But the information sharing between Cigna and Octopus has raised concerns about potential damage to customers' data privacy, said Carol Hui, assistant commissioner of insurance (policy and development) of the Office of the Commissioner of Insurance of Hong Kong, in an interview. Hui said the OCI is now "looking into the case."

Hui said "it would not be appropriate for us to offer any comments at this stage" as the case is under investigation. She also would not comment on whether the OCI will consider tightening existing regulations on insurance companies engaged in cross-selling activities with third-party companies.

A spokeswoman at Cigna Hong Kong declined to comment further because the case is under investigation.

Privacy Controversy

Following the disclosure of the information exchange between Cigna and Octopus for marketing purposes, the board of Octopus Holdings Ltd. said on July 25 that "on recommendation of its special committee on data privacy, the company and all its subsidiaries will no longer participate in any future activities that require the provision of customer personal data to merchant partners for marketing purposes."

The company added Octopus Rewards is "actively" working with Cigna and Card Protection Plan Ltd. toward the "early termination" of their cooperation agreements, which include the provision of certain customers' personal data for marketing purposes.

"This move is aimed at alleviating customer and public concerns on personal data handling," said Octopus in a statement. The company has apologized for concerns among customers and the public regarding the provision of personal data for marketing purposes.

Octopus earlier said it is taking a number of actions aimed at maintaining customer confidence in the company's data privacy policies and practices.

The Office of the Privacy Commissioner for Personal Data, Hong Kong, held a public hearing on July 26 on the Cigna-Octopus issue.

The commissioner also served summonses on the people in charge of Octopus Holdings, Octopus Rewards, Cigna and Card Protection Plan.

Cigna said it has been informed by Octopus Rewards regarding their decision. The company added it attended the public hearing to provide the information required and is cooperating fully with regulators' requests.

"Cigna reassures its customers and the public that the highest controls and standards have always been maintained with the limited customer personal data provided by ORL," the company said in a statement. "Cigna takes very seriously the responsibility to protect the privacy of our customers in Hong Kong and throughout the world."

The insurer provides health, life and accident insurance coverage to customers.

Hui said there are various confidentiality requirements in Hong Kong for insurers and insurance intermediaries to observe with respect to client information, which covers insurers, insurance agents and insurance brokers.

For insurers in Hong Kong, the Code on Conduct for Insurers provides that the collection of personal data by insurers and all personal data collected by an insurer is subject to the Personal Data (Privacy) Ordinance.

Insurers should ensure that their employees and insurance agents are aware of their obligations under the ordinance, which also requires insurers take all reasonable steps to seek to ensure that insurance agents keep client information confidential, according to the OCI.

For insurance agents, the Code of Practice for the Administration of Insurance Agents provides that agents treat all information supplied by a potential policyholder as confidential and comply at all times with the provisions of the Personal Data (Privacy) Ordinance when dealing with personal data provided by potential or current policyholders, noted the regulator.

Under Hong Kong insurance regulations, insurance brokers are also required not to disclose any information acquired from his client "except with the written consent of the client or in matters related to the administration of the concerned insurance contract."

(By Rebecca Ng, Hong Kong news editor: [email protected])