Hong Kong’s virtual insurance providers should make their personal data collection policies more transparent, a consumer watchdog has said, noting the information can be retained for undefined periods and shared with third parties in certain cases.

The Consumer Council on Thursday said its study of the four virtual insurance firms based in the city found they were able to share policyholders’ data with business partners, third-party service providers and regulatory bodies.

“The council reminds consumers to pay heed to the vast variations in narration and wordings of terms and conditions among different companies,” said Kyrus Siu King-wai, chairman of the watchdog’s publicity and community relations committee.

“All surveyed companies’ personal information collection statements mentioned that the personal data of the policyholder might be used in direct marketing or promotion.”

Among the four, only Avo Insurance specified a time frame for retaining consumers’ personal data. The provider can typically hold onto the information for seven years after the termination of a business relationship.

The other three – Bowtie Life Insurance, OneDegree Hong Kong and ZA Life – did not outline a time frame for holding onto the data.

Bowtie and ZA said that such data would be retained if it still fulfilled the intended purposes behind its collection and would be deleted once it was no longer required.

But both insurance providers’ statements broadly defined the purposes of data collection, including for designing, improving and enhancing products, as well as for research and statistical use.

The statements also said data would be retained to meet legal obligations and assist with investigations by regulatory bodies.

Hong Kong sees room to establish hub for catastrophe bonds amid climate crisis

With OneDegree, the council said the company stated that “customers’ personal data will be retained for as long as necessary for the performance of the services and as required by law”.

The council said three of the four companies used chatbots to deal with customer queries, but the answers were often the same as those found in online searches.

One of them also misidentified certain keywords in conversations, such as replying with cancer-related information when asked about electronic wallets or home insurance.

The council also found that three of the companies had reserved the right to introduce amendments or updates to their statements with immediate effect and without giving prior notice.

HSBC Life draws customers from 46 overseas markets as well as China

“Taking out an insurance policy may involve a large amount of sensitive personal data, consumers should read the documents carefully before agreeing to the relevant terms and conditions, to understand how their data will be handled and used by the insurance company to protect their rights and interests,” the watchdog said.

The council said the companies’ actions were not a breach of any privacy regulations.

The Post has reached out to the four virtual insurance providers for comment.

The companies were the subject of nine complaints over the first 11 months of this year, with most focusing on product pricing and payment methods. The watchdog received three complaints against the providers in 2022.

Insurer removes list of ‘unrecognised’ Hong Kong medical providers after outcry

Gilly Wong Fung-han, the council’s chief executive, said the companies did not account for a substantial share of complaints against insurance providers.

Traditional insurance firms have been the subject of 268 complaints so far this year, while the figure stood at 243 for 2022, she added.

Wong said the watchdog had decided to focus on user experiences in the virtual insurance market since the field was maturing in Hong Kong.

The council cited a complaint over pet insurance involving one virtual provider that had told the customer a corneal repair solution and painkillers given to their dog were not essential medications and therefore not covered by the policy.

The case involved about HK$1,800 (US$230) and was resolved when the watchdog intervened, prompting the insurance provider to make a new offer for the claim, it added.

According to the watchdog, there are no major differences in the regulatory requirements concerning the two types of insurance companies, since policyholders’ benefits are not affected if they use a virtual service.