個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0008/2013/IP

Title: Preset bank accounts for customers

Reason: Report

Brief:

    With the consent of its employees, Company A provided the personal data of the employees to Bank B for opening payroll accounts in Hong Kong Dollars. Meanwhile, without the consent of the employees of Company A, Bank B preset ATM cards, MOP savings accounts, and RMB savings accounts for the Company’s staff members to choose.
  As the act of Bank B may violate the Personal Data Protection Act (PDPA, or Law 8/2005), the Office for Personal Data Protection (GPDP) immediately filed an investigation after receiving a report.

Analysis:

 
  The data processing in this case is regulated by the PDPA according to its Articles 4(1)(1) and 3(1).
  It is well known that if a customer decided to use the autopay-out service, it is necessary to open an savings account with the bank, otherwise the autopay-out could not be established.  Therefore, when the employees of Company A accepted the autopay-out service of Bank B according to the agreement, it meant that they accepted the deposit services offered by Bank B and entered into a contract of general or comprehensive banking services with Bank B.  The staff members could also open accounts in various currencies with Bank B.
  Bank B opened payroll accounts in Hong Kong Dollars for the employees of Company A, and at the same time preset ATM cards, MOP savings accounts, and RMB savings accounts for them, which depend on the final decisions of the relevant employees. Understandably, based on the agreement between Bank B and Company A (which is also the free will of the staff members of Company A), Bank B used the personal data of Company A’s employees to open the mentioned accounts and ATM cards. The legitimacy Bank B’s personal data processing conforms with Article 6 of the PDPA, as it originates from the consent of the staff members, and (or) the contracts concluded between Bank B and the staff. 
  In addition, the regulatory authority for banking activities was also in the opinion that after Bank B established the mentioned Hong Kong Dollar accounts for the staff of Company A, the preset accounts of other currencies and the ATM cards are only usable after the staff also signed the concerning account opening documents. Such a practice did not violate the existing banking laws or regulations, but the relevant account-opening or transactions must meet the requirements of due diligence investigation of customers as required by the Financial System Act and those anti-money laundering laws and guidelines.
  In this case, the informer considered that Bank B only collected the personal data of Company A for the payroll accounts in Hong Kong Dollars, but Bank B also used the information for other presetting accounts and ATM cards is considered as the unauthorized use of personal data.  However, the above analysis reveals that the payroll accounts in Hong Kong Dollars, the MOP savings account, RMB savings account, and the ATM cards are the banking services all provided by Bank B, which are directly linked to the deposit services it offered and targeting the customers who opened savings account with it.  In addition to the explanation given by the mentioned regulatory authority, Bank B is not considered as processing the personal data for purposes other than those for the data collection. 
  In summary, Bank B did not violate the PDPA although it preset the ATM cards, MOP and RMB savings accounts based on the free will of Company A’s staff that chose its auto-payout accounts in Hong Kong Dollars.

Result:

    The GPDP has informed Bank B of the investigation result, which was also forwarded to the mentioned regulatory authority.  This case has been closed.

Reference:
Please refer to "Personal Data Protection Act", articles 3, 4, and 6 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116