Page:Unauthorised Access to Credit Data in the TE Credit Reference System.pdf/6

 With regard to how Softmedia monitored the use of the TE Credit Reference System by the money lending companies in order to detect and investigate any abnormal or improper access or use of the TE Credit Reference System, Softmedia stated that the user agreement entered into between Softmedia and the money lending companies stipulated that "[t]he purpose of this database is for the [money lending companies] to access the past credit records of the borrowers such as loan applications, loan repayment completed, delayed repayment, repayment in arrears, payment settled after being chased, bad debts and so on, for reference". Softmedia therefore relies on the money lending companies abiding by the user agreement and using the TE Credit Reference System as intended, and claimed that it was not able to monitor each of the companies individually.

Softmedia stated that the money lending companies are responsible for monitoring their employees' use of the TE Credit Reference System, such as through assigning authorised access to the database, restricting use inside or outside of the company, and removing staff access rights. Softmedia has no right to interfere with the personnel management of money lending companies.

According to the information obtained by the Commissioner, from 2021 to March 2023, Softmedia received 66 complaints from borrowers who stated that their credit data were accessed by unknown money lending companies. Of these, 59 complaints (i.e., nearly 90%) were substantiated after investigation. However, Softmedia merely issued warning letters to the companies in breach or suspended their use of the TE Credit Reference System for several days. The level of penalty depends on the number of contravention(s). For example, a user will initially receive a warning letter after a first contravention and be suspended from accessing the TE Credit Reference System for one day; the user's access will be suspended for five days on its second contravention and for 15 days after a third contravention; and its use of the TE Credit Reference System will only be permanently terminated after a fifth contravention. These penalties brought about minimal hinderance on the operation of the money lending companies and lacked deterrent effect.