The Hong Kong government has disclosed the companies involved in the production of its reusable face masks, after it came under fire for not disclosing the details how the manufacturer was selected. Meanwhile, the city’s privacy watchdog received more than 30 enquiries and complaints as online registration for the mask giveaway opened on Wednesday.
Speaking on RTHK’s Millenium show on Thursday, Annie Choi, permanent secretary for Innovation and Technology, confirmed media reports that the CuMask+ were manufactured by the Crystal International Group based in Hong Kong. It has a production line in Vietnam.
On Wednesday, local media named the Crystal International Group as one of the suspected manufacturers, after Chief Executive Carrie Lam visited a production workshop in Tsuen Wan.
According to local media, the company’s executive director Frankie Wong is also one of the directors of the Hong Kong Research Institute of Textiles and Apparel (HKRITA). The HKRITA is a government-funded organisation which was responsible for research and design of the reusable masks.
The government has been criticised for not conducting a regular tender process to choose the production firms, while some questioned where there was conflict of interest and transfer of benefits.
Choi said the government did not disclose the producer’s name because they did not want to “bother” the company. After getting approval from the firm on Wednesday night, they decided to announce the identity of the producer.
She also dismissed accusations of a transfer of benefits, saying that the company thought the project of making reusable masks was “very meaningful,” and was willing to bear the fluctuating costs in production and transportation.
“The company had some orders on their hands, but when they heard about this special project for Hong Kong, they freed up their factory to make a special dust-free area,” Choi said.
Data privacy concerns
The Innovation and Technology Bureau said as of Wednesday afternoon that close to 1.38 million citizens have registered for the CuMask+. The six-layer mask can “immobilise” bacteria, viruses and other harmful substance and is effective for 60 washes. After that, a filter replacement is needed, the government said.
Each registration can include up to six people, but every Hong Kong resident may only put their name down once. The system required applicants to provide the Hong Kong Identity card numbers, dates of birth and local mobile numbers of all registrants, as well as a local delivery address.
The collection of personal information during the mask distribution has raised concerns over information security and the government’s handling of the data. Craig Choy, former convener of the Progressive Lawyers Group, wrote on Twitter that the government had failed to state the purposes of data collection and whether the information would be transferred to any third party.
On the registration website, the government wrote that personal data collected would be used to confirm the eligibility of the registrants, detect fraud and handle duplicate registrants. It would also be used to carry out statistical analysis, which the government said would not be released to a third party.
Personal data collected may be disclosed to “relevant government bureaus / departments / organisations” – including the Immigration Department – for processing the registration, the website wrote.
“It is not mandatory for registrant(s) to provide the personal data as required in this registration. However, if registrant(s) do not provide such personal data, the Government will be unable to process the registration,” the website’s terms and conditions read.
In response to concerns over data collection and security, the Information and Technology Bureau said the purposes of information collection had been clearly displayed on the front page. The bureau said the information obtained for mask distribution would not be used by the government for other purposes.
“The Government will also ensure that the retention period of the personal data is not longer than the time required for the purposes for which the data is used,” a spokesperson of the bureau said.
The bureau added that the registration system operates on a government private cloud, with multiple security measures in place – including a firewall, intrusion detection and anti-bot technology. The system also passed an assessment on third-party impact to ensure it complies with the Personal Data (Privacy) Ordinance.
The city’s privacy watchdog told the public to be vigilant when providing personal data, and to ensure they were using the official registration site. The commissioner added that those who would like others to register on their behalf should “take extra caution” to prevent data being lost or stolen.
