HK privacy watchdog reveals 10 eateries' apps collect customers' data for marketing

Hong Kong's privacy watchdog has revealed that some restaurants in the city collect customers' personal data through mobile app ordering services for user tracking and direct marketing.

It comes after the Privacy Commissioner for Personal Data (PCPD) paid visits to 60 local restaurants from November 2023 to January 2024 to conduct tests on the collection and usage of customers' personal data by the restaurants concerned with the provision of electronic food ordering services. 

The 10 restaurants listed, including Café de Coral, Fairwood, Genki Sushi, KFC, McDonald's, Satay King, Starbucks, TamJai SamGor, TamJai Yunnan Mixian and Yoshinoya, offer in-app ordering services that track various customer data such as internet cookies, device information, transaction records, location, preferences and behaviours.

The PCPD also found that Satay King does not provide an option in its mobile app for customers to choose whether to consent to the use of their personal data for direct marketing purposes. 

Meanwhile, four restaurants, including Café de Coral, Fairwood, KFC and Yoshinoya, still collect customers' personal data when they check out as guests.

On the other hand, one of the restaurants, KIKI Noodle Bar (KIKI 麵店), did not provide a privacy statement explaining the purpose and use of collecting personal data before collecting customers' mobile phone numbers for ordering services.

The PCPD has reminded citizens to stay alert before scanning QR codes and pay attention to whether the codes have been tampered with. Moreover, citizens should pay attention to whether the mobile apps provide an option for customers to choose whether they accept direct marketing, and make corresponding choices based on personal needs.

Ada Chung, privacy commissioner for personal data, said: “Given that electronic food ordering is becoming increasingly common, customers should carefully consider whether they wish to provide personal data when placing food orders through mobile apps or QR codes, and the need to download and use the relevant apps.”

Simon Wong Ka Wo, president of the Hong Kong Federation of Restaurants and Related Trades, said on a radio programme that restaurants were not encouraged to collect customer data through mobile apps. If customers feel that their privacy is being violated, they can choose whether or not to provide the relevant information or to patronise the related restaurants.

He also said that some restaurant mobile apps specify that customer data is collected for internal use or promotion purposes only and will not be disclosed to third parties, which is a preferable practice.

Related articles:

HK privacy watchdog releases new guidelines on data breach handling
HK privacy watchdog to check credit reference agencies amid Softmedia's data breach crisis
HK privacy watchdog vows to monitor data privacy risks related to ChapGPT
HK privacy watchdog sees surge in doxxing complaints in 2022