# Unauthorised Access to Credit Data in the TE Credit Reference System

Investigation Report
Published under Section 48(2) of the Personal Data (Privacy) Ordinance (Chapter 486, Laws of Hong Kong)
Unauthorised Access to Credit Data in the TE Credit Reference System
Executive Summary
Background
* The Office of the Privacy Commissioner for Personal Data ("PCPD") received a complaint lodged by a member of the public. The complaint was related to the TE Credit Reference System.
* The TE Credit Reference System was developed and operated by Softmedia Technology Company Limited ("Softmedia").
Investigation Case
* The complainant had been obtaining loans from a number of money lending companies. On 28 December 2021, the complainant was informed by one of these companies that his credit records in the TE Credit Reference System had been accessed by several other money lending companies and he was asked whether he had recently encountered severe financial difficulties.
* The complainant stated that he was not aware of these money lending companies and had never applied for any loan from them. The complainant queried how they had obtained his authorisation to access the TE Credit Reference System. He was worried that the TE Credit Reference System's security measures were inadequate in protecting his personal data so that the money lending companies were able to access his credit data without his consent. The complainant therefore lodged his complaint with the PCPD.
Investigation by the Commissioner
* After making preliminary inquiries, the Privacy Commissioner for Personal Data (the "Commissioner"), in accordance with Section 38(a)(i) of the Personal Data (Privacy) Ordinance (the "Ordinance"), commenced an investigation regarding the subject complaint into the TE Credit Reference System operated by Softmedia.
* During the investigation, the Commissioner wrote to Softmedia on six occasions and received written replies and relevant documents from them. PCPD staff had also visited Softmedia's Kowloon Bay office, made inquiries with the representatives of Softmedia and obtained information pertinent to the case from the company.
* The Commissioner noted that Softmedia was not one of the credit reference agencies shortlisted by the Hong Kong Association of Banks, the Hong Kong Association of Restricted Licence Banks and Deposit-taking Companies, and the Hong Kong S.A.R. Licensed Money Lenders Association Limited (collectively "Industry Associations") under the Multiple Credit Reference Agencies ("MCRA") Model. Thus, it is neither regulated by these Industry Associations nor by ordinances related to the finance industry, such as the Money Lenders Ordinance (Chapter 163, Laws of Hong Kong) or the licensed money lenders' code of practice.
Findings and Contraventions
Background of Softmedia
* According to Softmedia's website, Softmedia was established in 1991 and focused on database establishment and interactive CD-ROM design. As network operating systems rapidly grew, Softmedia developed various new-generation software management systems for clients in fields such as loans, beauty salons, education, and retail, etc. Softmedia's clients included government departments, listed companies and small and medium-sized enterprises in various industries.
* With the aim of providing services to money lending companies and borrowers with access to and processing of credit data, Softmedia developed two systems and a mobile application, respectively known as the TE Credit Reference System and the Loan Management System for money lending companies, and the "MyLoan" mobile application for borrowers. Softmedia also used independent cloud servers for each of its systems and the mobile application to store the data collected.
TE Credit Reference System
* Softmedia stated that it established the TE Credit Reference System in January 2016, which was developed for the purpose of providing a platform on which money lending companies could assess the credit data of borrowers before deciding whether to approve or reject their loan applications. The TE Credit Reference System does not prescribe credit scores of individual borrowers.
* As of December 2022, around 680 money lending companies participated in the TE Credit Reference System, which involved credit data of about 180,000 data subjects.
"MyLoan" Mobile Application
TE Credit Reference System contained "personal data" as defined under the Ordinance
* Softmedia stated that the TE Credit Reference System only involves the HKID numbers and credit data of borrowers (i.e., data subjects) and does not store their names, addresses, phone numbers, dates of birth, or other personal data. The HKID numbers stored in the TE Credit Reference System are transformed into codes by an algorithm instead of complete HKID numbers.
* Softmedia explained that the process of transforming a HKID number into a code is irreversible. The actual HKID number of a borrower cannot be viewed in the TE Credit Reference System and the database only contains a set of codes with the corresponding credit data. Thus, Softmedia considered that the TE Credit Reference System does not contain any "personal data" of the borrowers.
* The Commissioner disagreed with Softmedia's view that it is not holding any personal data. In the Commissioner's opinion, although Softmedia stores HKID numbers in the form of codes, based on the unique and invariable characteristics of an HKID number and the fact that the same code would always be generated after inputting the same HKID number into the TE Credit Reference System, the code concerned is an identifier assigned to a borrower by Softmedia for its operation. This identifier can uniquely identify the borrower, thus constitutes a "personal identifier" and also "data" as defined under the Ordinance.
* From another perspective, Softmedia stated that the purpose of establishing the TE Credit Reference System is to provide reference data by way of a platform to money lending companies, so that they can make loan assessments based on the credit data of borrowers before deciding whether to approve or reject their loan applications. If the TE Credit Reference System did not hold personal data, the money lending companies could not achieve such purpose of making reference to the credit records of individual borrowers in assessing their loan applications.
* With regard to the subject complaint, the money lending company acquainted with the complainant was able to identify the complainant by combining data from the TE Credit Reference System and the Loan Management System, and thereby discovered that his credit data had been accessed many times. This demonstrates how it is practicable for the money lending companies to directly or indirectly ascertain the identity of a data subject from the data mentioned above, which therefore constitutes "personal data" under the Ordinance.
Actual operation of accessing the TE Credit Reference System
* According to Softmedia, a money lending company using the TE Credit Reference System must obtain a signed "Authorization Letter of TE Credit Information Inquirement" from the borrowers before it uploads and subsequently accesses any personal data of the borrowers on the TE Credit Reference System. The money lending company can access the TE Credit Reference System through its Loan Management System to make relevant inquiries. In the present case, the acquainted money lending company of the complainant learnt from the said channel that the complainant's credit data in the TE Credit Reference System had been accessed by eight money lending companies unacquainted with the complainant, and one of them had accessed his data three times within seven days.
* With respect to the present complaint and the intervention of the PCPD, Softmedia made inquiries and found that none of the eight money lending companies involved could provide the complainant's signed "Authorization Letter of TE Credit Information Inquirement". Each provided a different explanation, such as "probably because of the recent follow-up with the complainant on his repayment status and made the loan inquiry"; "the complainant agreed to upload loan data to the database in 2020"; "the company's normal procedures would provide an authorisation letter"; "the complainant had inquired about the loan issue, but the application was not approved"; and "the authorisation letter should have been filled in, but the company was moving office at the time, the document handling process was in a mess". One of the companies even stated that "a former employee accessed the database without the company's authorisation and the employee was fired".
* Although Softmedia required the money lending companies to declare that they had obtained the consent and authorization of the borrowers before they could access the credit data in the TE Credit Reference System, the investigation revealed that the money lending companies could freely access the credit data in the TE Credit Reference System without complying with this requirement. Softmedia did not appear to have examined the statements of consent and authorization letters from the borrowers that the money lending companies should have obtained. Thus, a contravention loophole is plainly apparent.
* With regard to how Softmedia monitored the use of the TE Credit Reference System by the money lending companies in order to detect and investigate any abnormal or improper access or use of the TE Credit Reference System, Softmedia stated that the user agreement entered into between Softmedia and the money lending companies stipulated that "[t]he purpose of this database is for the [money lending companies] to access the past credit records of the borrowers such as loan applications, loan repayment completed, delayed repayment, repayment in arrears, payment settled after being chased, bad debts and so on, for reference". Softmedia therefore relies on the money lending companies abiding by the user agreement and using the TE Credit Reference System as intended, and claimed that it was not able to monitor each of the companies individually.
* Softmedia stated that the money lending companies are responsible for monitoring their employees' use of the TE Credit Reference System, such as through assigning authorised access to the database, restricting use inside or outside of the company, and removing staff access rights. Softmedia has no right to interfere with the personnel management of money lending companies.
* According to the information obtained by the Commissioner, from 2021 to March 2023, Softmedia received 66 complaints from borrowers who stated that their credit data were accessed by unknown money lending companies. Of these, 59 complaints (i.e., nearly 90%) were substantiated after investigation. However, Softmedia merely issued warning letters to the companies in breach or suspended their use of the TE Credit Reference System for several days. The level of penalty depends on the number of contravention(s). For example, a user will initially receive a warning letter after a first contravention and be suspended from accessing the TE Credit Reference System for one day; the user's access will be suspended for five days on its second contravention and for 15 days after a third contravention; and its use of the TE Credit Reference System will only be permanently terminated after a fifth contravention . These penalties brought about minimal hinderance on the operation of the money lending companies and lacked deterrent effect.
Softmedia Contravened Data Protection Principle 4(1)
Unauthorised Access to the Credit Data
* Data Protection Principle 4(1) in Schedule 1 to the Ordinance provides that all practicable steps shall be taken to ensure that any personal data (including data in a form through which access to or processing of the data is not practicable) held by a data user is protected against unauthorised or accidental access, processing, erasure, loss, or use.
* The participating money lending companies are only charged when they use the TE Credit Reference System (i.e. a money lending company can gain unlimited access to a borrower's credit data for five days with a payment of $2, and this five-day cycle can be repeated with no limits set in terms of payment or access). Thus, a money lending company can gain unlimited access to the credit data of a specific borrower as long as it declares that it has obtained authorisation from the borrower and pays the fees. The investigation revealed that Softmedia neither restricted the number of times the money lending companies can access a borrower's data nor regularly monitored their use of the TE Credit Reference System. Softmedia did not, for example, actively monitor or detect any abnormal access by money lending companies through audit trails.
* The Commissioner understands that money lending companies may bear higher financial risks than banks when granting loans to individuals. They may have to closely track a borrower's financial status and credit record. However, this does not mean that money lending companies may access borrowers' credit data without restrictions. As the operator of the TE Credit Reference System, Softmedia should strike a reasonable balance between the actual needs of the money lending companies and the protection of personal data privacy and formulate measures to regulate and monitor the use of the TE Credit Reference System by these companies, such as limiting the maximum number of times they can access the credit data of a borrower within a certain period, to ensure compliance with Data Protection Principle 4(1) of the Ordinance.
* This complaint also revealed that at least eight money lending companies unacquainted with the complainant, let alone with his consent or authorisation, accessed his credit data. Regrettably, Softmedia relies on the money lending companies to declare whether they have obtained the ​consent and authorisation of the borrowers without considering the possibility that certain money lending companies may make use of this loophole to gain unrestrained access to the credit data. This arrangement falls far below the general standard and is highly disappointing, both in terms of compliance with legal requirements and the protection of borrowers' privacy.
Weak Password Management
* According to the information provided by Softmedia, the money lending companies can only log in to the TE Credit Reference System via its Loan Management System by inputting a password. Although Softmedia claimed that it has set specific requirements regarding the minimum length and complexity of these passwords, the money lending companies can in fact use a password that is considered weak in terms of length and complexity.
* In addition, Softmedia does not set restrictions in its System requiring the money lending companies to regularly change their passwords. The money lending companies can set a password in the System as they wish and the use of the same password over a long period means that employees can potentially obtain the password with ease to enter and access the TE Credit Reference System without authorisation by the companies and continue to do so after leaving the companies, rendering the security function of the password virtually useless.
Conclusion
* The investigation revealed that the TE Credit Reference System is akin to an open credit data platform used by licensed money lenders. Licensed money lending companies can have unlimited access to credit data at a very low fee. The passwords of the TE Credit Reference System can be freely set by the money lenders, and it is doubtful whether the TE Credit Reference System can in fact effectively prevent improper or illegal logins.
* This situation raises concern, as the TE Credit Reference System contains personal data of about 180,000 borrowers and up to now, the TE Credit Reference System is used by as many as 680 money lending companies. It is therefore a sizeable credit reference database. Credit data is generally ​regarded as sensitive personal data, and any improper or unauthorised access to them can result in serious financial losses and violate the privacy of the data subjects concerned. Softmedia, as the operator of the credit reference database, apart from providing accurate credit data and highquality services to the money lending companies and data subjects, should also take appropriate security measures in accordance with the requirements of the Ordinance. It should continuously monitor and review the use of the database so that it can detect and investigate any abnormal or improper access or use of the data so as to meet the expectations of the general public and protect the personal data held by Softmedia against unauthorized or accidental access, processing or use.
* The investigation revealed that the complainant's personal data was accessed, processed, or used without his authorisation because Softmedia did not take appropriate security measures to monitor and manage the access to and use of the TE Credit Reference System by money lending companies, which is regrettable. In addition, Softmedia has not adopted a strong password policy, or set expiration dates for passwords, notwithstanding the amount and nature of the relevant data. The current operation does not meet the basic requirements of network security, which shows that Softmedia has not taken adequate measures to protect personal data. In the present case, the Commissioner considers Softmedia to have failed to take all practicable steps to protect the personal data in its TE Credit Reference System against unauthorized or accidental access, processing or use and is of the opinion that Softmedia has contravened the requirements of Data Protection Principle 4(1) on the security of personal data.
Softmedia Contravened Data Protection Principle 2(2)
Softmedia Retained the Credit Records of Those Who Had Completed their Repayments for More Than Five Years
* Data Protection Principle 2(2) of the Ordinance provides that all practicable steps must be taken to ensure that personal data is not kept longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is or is to be used.
* The Code of Practice on Consumer Credit Data ("the Code") was issued for the purpose of providing practical guidance with respect to any requirements under the Ordinance imposed on data users. In particular, paragraphs 3.3, 3.3.1, 3.3.2, 3.4A and 3.4B of the Code specify the retention period of account repayment data (including account repayment data revealing or not revealing material default) in the credit reference agency's database. In case of material default, the credit reference agency can only retain the account repayment data in its database up to five years either from the date of final settlement of the amount in default or from the date of the individual's discharge from bankruptcy, whichever is earlier.
* Softmedia stated that for a borrower to delete credit data from the TE Credit Reference System, it must first establish that the borrower (i) has completed all repayments and (ii) at least five years have passed from the date of final settlement of the debt. If these conditions are satisfied, the borrower may request the money lending company to notify Softmedia to delete the relevant credit data, but Softmedia will not proactively delete the credit data from the TE Credit Reference System.
* Softmedia confirmed that the TE Credit Reference System holds over 50,000 credit records of which at least five years have passed from the date of final settlement of the debt.
* The Commissioner understands that the industry has to use this material default information to assess whether to grant loans, and the absence of such payment information may impair the ability of money lending companies to assess a borrower's financial situation. Nevertheless, such consideration should not be a reason for indefinite retention of a borrower's credit record by a credit reference agency which is noncompliant with the requirements of Data Protection Principle 2(2). Softmedia must therefore set a retention period for credit data if repayments have been completed, and such data cannot be retained indefinitely.
Conclusion
Enforcement Actions
Recommendations
* Section 48(2) of the Ordinance provides that the Commissioner may, after completing an investigation and if she is of the opinion that it is in the public interest to do so, publish a report setting out the results of the investigation, any recommendations and other comments arising from the investigation as she sees fit to make.
* This investigation involved the personal data of a significant number of members of the public. Therefore, in addition to serving an Enforcement Notice pursuant to Section 50(1) of the Ordinance, the Commissioner would like to make the following observations and recommendations through this report to Softmedia and other operators of credit reference databases.
The Commissioner's Observations
* Credit data is currently an important indicator of an individual's financial credibility and borrowing capacity. With the development of the digital economy, the proper handling and protection of credit records are essential for protecting personal data privacy and ensuring financial data security. The public will reasonably expect that their personal credit data, whether positive or negative, would be adequately protected by credit reference agencies and would not be subject to unrestricted access by unauthorised or unrelated organisations.
* The Commissioner noted that the current operation and management of the TE Credit Reference System is neither regulated by the industry code nor the relevant laws of the financial sector, including the Money Lenders Ordinance (Chapter 163 of the Laws of Hong Kong) and the code of practice of licensed money lenders, and the situation is far from satisfactory. To ensure the data security of the database and the protection of borrowers' personal data privacy, the Commissioner recommends that the operation and management of any credit reference database be regulated or supervised through laws, regulations, guidelines, industry codes or licensing systems. It is of crucial importance that appropriate penalties should be imposed on wrongdoers, that the privacy of borrowers should be adequately protected, and the security of the database should be properly safeguarded.
Implementing a Personal Data Privacy Management Programme
Appointing Data Protection Officer(s)
Appointing an Independent Compliance Auditor
Adopting Strict Penalties for Contravention
* In the present case, the Commissioner considers that the punishment by Softmedia of merely suspending the contravening money lending companies from using the TE Credit Reference System for a few days was inadequate.
* As money lending companies require the use of the data in the credit database as reference before approving loan applications, the Commissioner considers that any companies in contravention should not be lightly allowed to continue to use the TE Credit Reference System. Apart from limiting the number of periods or times they can access the credit databases, other penalties (for example, increasing the access fee or fines, etc.) should be considered, and the operators of the credit databases should, depending on the circumstances, consider terminating the access rights of the relevant money lending companies.
Annex 1
Authorization Letter of TE Credit Information Inquirement
Authorization Letter of TE Credit Information Inquirement TE信貸資料查詢授權書
I, User's Name (HKID No./Other Document No. aaa) hereby authorize **** Loan Company Limited to inquire my related loan information for processing the loan application and repayment within the "TE Credit Reference System "hereafter. "Information" includes applied amount, installment periods, approval, rejection, payout, overdue payment, arrears, OCA, bad debt, and interest arrears. (Exclude the personal information: phone number, address and date of birth)
本人 User's Name (香港身份證 / 其他證件號碼：aaa) 僅此同意及授權 ****財務有限公司 是次及將來有權查詢本人於 TE信貸資料庫內由 TE信貸資料庫其他會員 (即信貸資料提供者) 提供的信貸資料，信貸資料包括本人之申請金額、期數、批核、拒絕、放款、逾期還款、拖欠、交追數、撇帳及現時尚欠本息的部分或全部資料 (但不包括本人之電話、住址、出生日期)，用作審批貸款申請及了解日後還款情況之用途。
Declaration 聲明
Inquiry / change of personal particulars
The Borrower have right to request his/her personal credit report from Softmedia Technology Co. Ltd., who operates "TE Credit Reference System", or check the report through Application "MyLoan".
查詢 / 更改個人借貸資料
借款申請人日後亦可向提供 TE 信貸資料庫服務的機構 Softmedia Technology Co. Ltd. 要求索取個人信貸資料報告或透過 MyLoan App 註冊及認證後自行查閲自己的信貸資料報告。
If any information of the TE credit report is found to be incomplete, misleading or inaccurate, please contact Softmedia Technology Co. Ltd. by email support@softmedia.hk.
如發現信貸資料報告的資料有錯漏或不實，可聯絡 Softmedia Technology Co. Ltd. 作出跟進，電郵 support@softmedia.hk
Requirement of TE credit report from Softmedia Technology Co. Ltd. might charge a service fee.
透過索取或MyLoan App 查詢信貸資料報告，Softmedia Technology Co. Ltd. 會收取適當及合理的費用。
The Chinese version shall prevail.
英文譯本僅供參考，合同以中文版本為準。
Signature 簽署
| Name 姓名 | : | User's Name |
| Date 日期 | : |
* ↑ https://www.hkab.org.hk/DisplayWhatsNewsAction.do?lang=en&id=7611&ss=1
* ↑ According to these Industry Associations, "for consumers, the MCRA Model will enhance the governance of data access and use by the selected credit reference agencies with a more stringent data security code... sets out the standards and requirements for the selected credit reference agencies and subscribed members to comply on various aspects including corporate governance, internal control, use and protection of consumer credit data."
* ↑ https://softmedia.hk/
* ↑ Under Section 2(1) of the Ordinance, "personal data" is defined as any data relating to a living individual in a form in which access to or processing of the data is practicable, and from which it is practicable for the identity of the individual to be directly or indirectly ascertained.
* ↑ Under Section 2(1) of the Ordinance, "personal identifier" means an identifier (a) that is assigned to an individual by a data user for the purpose of the operations of the user; and (b) that uniquely identifies that individual in relation to the data user, but does not include an individual's name used to identify that individual.
* ↑ Under Section 2(1) of the Ordinance, "data" means any representation of information (including an expression of opinion) in any document, and includes a personal identifier.
* ↑ Not disclosed in this report for security reasons.
* ↑ For details, please refer to the "Code of Practice on Consumer Credit Data" published by the PCPD at: https://www.pcpd.org.hk/english/data_privacy_law/code_of_practices/files/CCDCode_2013_e.pdf
* ↑ In the Code, "Material default" means a default in payment for a period in excess of 60 days (see paragraph 1.20).
* ↑ For details, please refer to "Privacy Management Programme—A Best Practice Guide" published by the PCPD at: https://www.pcpd.org.hk/english/publications/files/PMP_guide_e.pdf
This work is released under the Creative Commons Attribution 4.0 International license, which allows free use, distribution, and creation of derivatives, so long as the license is unchanged and clearly noted, and the original author is attributed.
Public domainPublic domainfalsefalse