Personal data privacy of clients
An intermediary has to collect each individual client’s CID, including name and identity document number, type, and place of issue. If the client has a Hong Kong identity card but uses different identity documents to open securities accounts, the intermediary should follow up with the client to update the CID with his/her Hong Kong identity card information.
To comply with the Personal Data (Privacy) Ordinance of Hong Kong, intermediaries have to obtain their clients’ consents before submitting their CID to the SEHK. Clients who do not give consents will not be able to purchase securities through the intermediaries but will still be able to sell their securities. Also, the BCAN should not be generated, assigned or handled in a way which would identify any individual client, compromise the confidentiality of the client’s identity, or give rise to non-compliance with the applicable privacy laws.
With reference to the industry standards and practices, the SFC and SEHK have considered appropriate measures to ensure the security and confidentiality of CID in aspects including data transmission/storage, access to CID, incident management and cybersecurity.
Practical impacts
When taking steps to comply with the investor identification regime, intermediaries are enhancing data security for their clients. Some of them are taking this opportunity to make additional investments in financial technology at the same time, in order to further develop online and mobile clientele and businesses.
The new regime is also described as a “real-name system” for Hong Kong securities trading. In the past, there were incidents where different investors used the same securities account to participate in Hong Kong securities trading. This practice may cease because orders placed by persons other than the securities account holder will be tagged with the BCAN of the account holder who may no longer be willing to let other persons’ orders be taken by the regulators as his/her own orders.
(The author would like to thank Ms. Mandy Kong (paralegal) for her contribution in this article.)