In January, the Office of the Privacy Commissioner for Personal Data unearthed inadvertent online exposure of sensitive personal information of students: student identification numbers, telephone numbers, names of students and parents, their email addresses, etc. All of which could be used for fraudulent ends. The personal information of as many as 8,505 students at 11 local educational institutions, including tertiary institutions, might be compromised. The news has aroused public condemnation.

Other cases of both inadvertent and intentional personal information disclosure have occurred in the past. In some instances, personal data leaked due to governmental misconduct in some departments, triggering public criticism. Meanwhile in 2010, a mighty uproar from local society followed condemning media reports that Octopus (the company responsible for the all-purpose metro fare card) had participated in activities that require the provision of customer personal data.

All these cases indicate that protecting and respecting personal information should be considered one of Hong Kong's core values. Recently, the government launched consultation on legislation proposed under the new Companies Ordinance, in which disclosure of full identification numbers and usual residential addresses of shareholders, directors (or company secretaries, etc.) would be restricted, with the purpose of protecting the current and former company directors in Hong Kong. As reasonable as this proposal seems, it is contrary to expectation that it would become controversial. Nevertheless, the ordinance is now another social controversy.

Generally speaking, the significance of personal privacy protection cuts across all classes of people.Take employee data for example. Such information should be strictly protected by personnel departments - no one, even the staff, should access personal data without permission. The private information of company directors should be theoretically included in the protected scope, too. As a matter of fact, however, at present, anyone is able to inspect the full ID numbers and addresses of shareholders so long as he or she pays only HK$40 to the Companies Registry. Isn't this a bit unfair to company directors?

When the question was discussed at the meeting of the Legislative Council, some councilors pointed out that the regulation "will undermine the public's right to know and obstruct media reporting", suggesting a postponement in introducing the regulation to LegCo. On the other hand, some labor groups queried how the potential measures would affect workers seeking back pay without directors' personal data. Media groups advocating information transparency also send a petition calling for withdrawal of proposed privacy protections.

From my point of view, I don't think any of the aforesaid reasons can be justified. For recovering arrear of wages, instead of assembling workers to besiege a director's house, one should actually seek help from the Labor Department and abide by related legal procedures. In regard to queries about the veracity of company accounts, the Commercial Crime Bureau should be sufficient. If the responsible company director goes missing, the right thing for us to do is to ask for the police to investigate.

Let's ask ourselves some questions: Must the public's so-called "right to know" include the details of ID card numbers and residential addresses? Can we put the privacy and danger of the directors and their family at risk just for the sake of "not obstructing media reporting" so that it's more convenient for them to inspect personal information?

Moreover, if some criminals intentionally pay only HK$40 to inspect the full ID numbers and addresses of shareholders of the companies with good performance, they are very likely to commit a crime by "paying a visit" to rob or kidnap. Or the directors' ID numbers could be used for fraud schemes.

In a society such as Hong Kong where the rule of law is upheld and it enjoys a transparent legal system, the limited liability in a company, as far as I'm concerned, should not include such private data, or at least not include the exact details. If the protection of shareholders' personal information is not strengthened, it makes no difference from exposing them and their family members to danger, risking the safety of their lives and properties. How is this situation, to any degree, reasonable to them?

The author is vice-president of the Chinese Manufacturers' Association of Hong Kong.

(HK Edition 02/07/2013 page10)