Tag: data protection

  • Facebook, Google, Twitter considering quiting Hong Kong

    Facebook, Google, Twitter considering quiting Hong Kong

    US tech giants Facebook, Google, and Twitter have privately warned the Hong Kong government that they could stop offering their services in the city if authorities proceed with planned changes to data protection laws, the Wall Street Journal reported on Monday, citing a letter.

    The laws could make the tech companies liable for the malicious sharing of individuals’ information online, the newspaper added.

    A letter sent by an industry group that includes the internet firms said companies are concerned that the planned rules to address “doxing” could put their staff at risk of criminal investigations or prosecutions related to what the firms’ users post online, Journal reported.

    Doxing is an act of revealing people’s personal information such as real name, home address or workplace online without the user’s permission.

    Facebook, Google, and Twitter did not immediately respond to Reuters’ requests for comment.

    Hong Kong’s Constitutional and Mainland Affairs Bureau in May proposed amendments to the city’s data-protection laws that it said were needed to combat doxing, a practice that was prevalent during 2019 protests in the city, the newspaper said.

    According to the newspaper, the letter dated June 25 was sent by the Singapore-based Asia Internet Coalition.

    “The only way to avoid these sanctions for technology companies would be to refrain from investing and offering the services in Hong Kong,” the Journal reported, quoting the letter.

  • Indonesian Consumers Face Harassment by Fintech Debt Collectors

    Indonesian Consumers Face Harassment by Fintech Debt Collectors

    As a result, she faces constant harassment by debt collectors who call her, wait outside her home, and even go as far as contacting her parents, family members, friends and acquaintances. “I was not expecting these fintech firms to subject their customers to such dreadful practices. They accessed my contact list and messages [on my mobile phone]. They even called my current bosses,” Cintia said.

    “My friends even told me that these fintech firms were defaming and harassing them, sending my friends’ personal photos to their bosses and some of the people in their contact lists, calling my friends imposters,” she added.

    The trouble started a few months ago after she borrowed Rp 1 million each from Uang Kita, Kantong Darurat and Perdana (previously known as Rupiah Plus).

    Risks Associated With Collateral-Free Loans

    Each fintech firm has a different set of requirements borrowers must meet, but most of them do not ask for any collateral, which comes with one major drawback: high interest rates.Despite customers only needing an identity card and a cellphone number to borrow emergency cash, these loans carry interest rates of 1 percent per day for a maximum tenor of 14 days. This exceeds by far the already steep interest rates of 29.9 percent per year that credit card companies charge their customers.

    Customers must also be prepared for some unpleasant treatment from these fintech firms if they fall behind on their repayments.

    “At first, I started borrowing money just for fun but I ended up with these debts and I’m making one debt to pay another debt. I want to pay it off in installments, but they refuse to accept it. They want me to settle the loans in full,” Cintia said.

    Misna Wati, who works for an undisclosed company in Jakarta, has owed money to 25 fintech firms since May last year. She said she regularly receives harassing phone calls and WhatsApp messages from debt collectors and representatives of the firms.

    “We are worried all the time. We did not expect them to be able to access our contacts, call logs, even messages,” said Misna, who declined to state her age and occupation.

    Misna and Cintia are now both seeking assistance from the Jakarta Legal Aid Institute (LBH).

    Need for Strong Data Protection

    With numerous reports about breaches of data privacy by the financial industry, the House of Representatives must accelerate the process involved in passing the data protection bill.The bill, which was supposed to be enacted last year, has now been included in the 2019 priority list of the National Legislation Program, which means that the House might deliberate it sometime this year.

    While Ministerial Regulation No. 20 of 2016 is intended to protects users’ personal data on the electronic system, it is deemed insufficient in preventing large-scale data breaches.

    The regulation only stipulates administrative penalties for violations or the settling of disputes between offenders and system providers or data owners, but does not allow for the recovery of damages related to customer data breaches.

    The bill, if it is passed into law, would apply both in Indonesia and abroad, but only to Indonesian citizens and Indonesia-based business entities.

    The regulation is very important as Indonesia has more than 143 million internet users, which is more than half of the country’s population, according to data compiled by the Internet Service Providers Association (APJII) in 2017.

    Fintech’s Popularity

    Fintech services have gained popularity in Indonesia over the past few years due to their seamless technology systems, innovation, customer-focused approach and simplicity. Fintech companies also offer payment systems, financial assistance and fundraising options.According to a joint study by global technology giant Google and Singaporean wealth fund Temasek, Indonesia’s internet economy – the financial value of all digital services – could exceed $100 billion by 2025, compared with $27 billion last year.

    But despite numerous benefits, the microcredit industry is still poorly regulated in Indonesia and the government is currently dealing with a rising number of illegal or unlicensed fintech firms operating in the country.

    The government banned 738 illegal financial technology websites and applications last year in a bid to protect consumers.

    As Indonesia is now one of the centers of the digital financial industry in the region, it attracts numerous companies from neighboring countries that establish a presence in the country, but which often choose not to obtain licenses from industry regulator, the Financial Services Authority (OJK).

    Most of the unlicensed fintech apps and websites are from China, Malaysia and Thailand. These fintech firms do not have registered offices, either in Indonesia or in their home countries.

    “The OJK has instructed us to ban unlicensed fintech websites and apps,” Ferdinandus Setu, acting head of public relations and communication at the Ministry of Communication and Information Technology, said in a statement last week.

    He said the ban so far applies to 211 websites and 527 smartphone apps, which seemed to have been increasing since August last year.

    There were 171 illegal fintech apps available for download on Google Play in November last year, compared with 144 in August. The ministry also recorded 77 illegal fintech websites in September.

    The ministry said no illegal fintech websites and apps were recorded between January and July last year.

    Ferdinandus said besides the OJK’s instruction, the communication ministry’s actions were also carried out after collecting public reports through a web crawler known as AIS, which filters out content deemed illegal under Indonesian law, such as pornography, the spreading of false news and the promotion of terrorism and radicalism.

    The ministry encouraged members of the public to report websites offering financial services that may be deemed illegal, or fintech companies that are not registered with the OJK.

    Reports can be submitted to aduankonten.id, or @aduankonten on Twitter. A task force comprising more than 13 ministries and agencies will investigate the reports.

  • HKBN to strengthen data protection measures

    HKBN to strengthen data protection measures

    Hong Kong Broadband Network (HKBN) has promised to implement new data protection measures for its customer data in the next three months in response to a targeted cyberattack discovered last week.

    Under the new measures, all personal information of customers whose accounts have been closed will be kept for six months, instead of seven years, and will subsequently be deleted from the company’s database.

    Furthermore, HKBN would modify the way its stores the data of existing customers. Hong Kong ID card numbers would be randomly removed, as well as the digit in brackets. For credit card numbers, the company would delete the seventh to 12th digits.

    “Keeping only partial but not all of the most sensitive data like credit card number and Hong Kong ID card number gives peace of mind to our customers,” said William Yeung, co-owner and CEO, HKBN.

    For new customers, their full identity card number and credit card number would be collected only to support service activation, number porting and bank payment application. Once these procedures have been completed, part of the said two numbers would also be deleted from the HKBN system.

    Yeung said the new policy would make the information less attractive to hackers, adding that the company is taking decisive actions beyond the industry’s common practices.

    The new data protection measures would be implemented after they cleared with the relevant government departments.

    The targeted cyberattack, discovered on April 16, involved the hacking of an inactive customer database containing the information of some 380,000 customer and service applicant records of HKBN fixed and IDD services as of 2012, which represents about 11% of the company’s 3.6 million customer records.

    The information in the database includes names, home addresses, email addresses, telephone numbers and HKID card numbers. It also contains information of some 43,000 credit card information as of 2012.

    HKBN had reported the incident to the Hong Kong Police and the Office of the Privacy Commissioner for Personal Data. Investigation into the incident is on-going.

    “No conclusion of the incident investigation is available yet, but we’ve already identified the areas that we will definitely address to enhance data security protection such as introducing multi-factor authentication, stepping up encryption, putting up additional layers of cyber defenses on top of our existing protections, and burgeoning resources to expand the information security team,” Yeung said.