Property Management Involves Multidisciplinary Professional Services

Property management is closely related to citizens‘ daily lives. Property management bodies are indispensable to proper management of residential buildings, commercial buildings, industrial buildings, shopping malls, clubhouses and carparks. Property management involves multidisciplinary professional services, including general property management services, environmental management of properties, ipad 10 screen repair and maintenance of properties, facility management, finance and asset management, human resources management, and legal services related to properties. Such duties as visitor registration, resident card application, issuance of circulars, handling of complaints and litigation, staff management involve the processing of a massive amount of personal data. 2. The Office of the Privacy Commissioner for Personal Data (PCPD) receives enquiries and complaints about the property management industry’s processing of personal data from time to time. During the past five years, the PCPD received an average of more than 100 complaints against the property management industry per annum. To raise this industry’s awareness of protection of residents and visitors‘ personal data privacy, the Privacy Commissioner for Personal Data (Commissioner) publishes this investigation report in respect of four complaints recently received by the PCPD against property management companies.

These four complaints involved collection, retention and use (including disclosure) of personal data. Through this report, the Commissioner wishes to remind property management bodies to comply with the relevant requirements under the Personal Data (Privacy) Ordinance (Ordinance), Chapter 486, Laws of Hong Kong, in their daily practices, and to remind members of the public to protect their own personal data privacy when providing their personal data for property management bodies. 1. On 8 March 2022, the PCPD received a complaint against Cheong Sun Property Agent and Management Company (Cheong Sun), which was responsible for the property management of Scenic Garden in Cheung Chau. Cheong Sun was alleged to have posted a notice on overdue arrears to be collected from property owners and a list containing the full English names, full addresses and the amounts in arrears of 48 owners (List) on a notice board located in the public area of the property. Moreover, Cheong Sun also put copies of the notice and the List into the mailboxes of those 48 owners.

1. DPP3(1) and (4) of Schedule 1 to the Ordinance stipulates that personal data, without the express and voluntary consent of the data subject, shall only be used (including disclosed or transferred) for the purpose for which the data was to be used at the time of the collection of the data, or a purpose directly related to the purpose. 2. When it comes to posting of notices containing personal data, generally speaking, property management companies have a duty to inform property owners of the issues which may affect their interests. Public display of notices for discharge of the above duty is related to building management. However, property management companies should carefully consider and assess the necessity of publishing information containing an individual’s personal data and the amount of data involved, especially when sensitive personal data is involved. 3. In this case, Cheong Sun aimed to inform property owners by the notice that those 48 owners‘ overdue payments had put financial strains on Scenic Garden, and reminded those owners of their duty to pay the arrears as soon as possible.

The Commissioner considered that Cheong Sun should have been able to collect the payment of arrears by putting separate notices into the mailboxes of the 48 owners, without any need to attach the List. Moreover, even though Cheong Sun intended to inform other property owners that 48 owners had not paid on time, it was unnecessary to post in public the personal data of those 48 owners. Under the above circumstances, the Commissioner considered that Cheong Sun had contravened the requirements of DPP3(1) as regards the use of personal data in the present case. 1. The Commissioner has served an Enforcement Notice on Cheong Sun directing it not to unnecessarily disclose property owners‘ personal data to third parties when it tries to recover arrears in the future, unless express and voluntary consent of the data subject is obtained, or the disclosure is otherwise in compliance with the law. Moreover, the Commissioner also directs Cheong Sun to formulate clear written policies and guidelines for staff compliance; circulate policies and guidelines among staff on a regular basis; and provide staff training to raise their awareness of personal data protection to prevent recurrence of similar contravention of the Ordinance.

1. Creative Property Services Consultants Limited (Creative Property Services), which was responsible for the management of Ching Ho Estate in Sheung Shui, assisted the government in distributing face masks to households in June 2021. Residents who had registered at the main lobby and collected a box of face masks must fill in their names, unit numbers and collection dates on the „Mask Receipt Record“ (Receipt Record), and acknowledged receipt of the masks with signature. 2. According to the complainant, Creative Property Services had failed to adopt any measures to cover the entries on the Receipt Record, which was a common form. He could see the personal data of other recipients when he signed on the Receipt Record. Moreover, the complainant stated that the staff of Creative Property Services had placed the Receipt Record in a paper box beside a work desk, without covering relevant records. Hence, the complainant believed that Creative Property Services had not properly protected the personal data of the residents who had collected their masks as stated in the Receipt Record.

visit south shop

https://maps.app.goo.gl/cAKYMmsGriJV9ERt5