A sales supervisor at a telecommunications company was given easy access to the central database of telephone subscribers. A friend put him in contact with a debt collector, who offered him HK$80 to HK$100 to retrieve the personal data of each individual telephone subscriber. The sales supervisor accepted the deal and regularly faxed the requested information to the debt collector. In 26 months, he received a total of over HK$30,000 through 18 deposits made into his bank account.
Divulging information to unauthorised parties for personal gain is a criminal act under anti-corruption law. The sales supervisor had committed Section 9 of the Prevention of Bribery Ordinance. Leaking customers’ personal data is also a breach of the Personal Data (Privacy) Ordinance and can expose the company to damaging lawsuits.
In a case of this kind, a great deal of time was usually required in identifying the suspect during the investigation, because the client database was open to many staff members for reasons of operating efficiency. If no security measures were in place to control the retrieval of information, innocent staff would be unhappy to find that they were suspected of the illegal act when investigation was required. Besides, some staff members like the sales supervisor in this case might consider it a trivial matter to trade client information for some extra cash, especially when the information was so easily accessible.
Where important data such as customer details, business plans, product designs, etc., are kept in digital formats, this becomes an area that is vulnerable to corruption and related crimes. Managers must therefore be vigilant in maintaining the security of valuable information. Irrespective of the format in which it is stored, managers should classify information into different security levels according to the degree of sensitivity and confidentiality. This helps prevent unauthorised access.
It is crucial that managers inform staff clearly of the serious consequences, both for themselves and for the company, that can result from the unauthorised disclosure of company information. The human resources policy of the company should be regularly reviewed and constantly enforced to provide the necessary deterrents against misconduct, e.g. any breach will result in dismissal and report to the relevant law enforcement agencies.
Ivan had been in the toy business for many years. Some years ago he became a shareholder of a Shanghai-Hong Kong joint venture. Because of Ivan's substantial experience in the toy trade, he took charge of the production line, and divided much of his time between Hong Kong and Shanghai.
Ivan often made all the procurement and purchasing decisions, and was often offered with entertainment and gifts by many suppliers. One of these suppliers even went so far to offer Ivan a commission of five per cent of the value of each contract, as a reward for Ivan’s placing orders for industrial chemicals with their company. Ivan had received a total of HK$250,000 illegal rebates or commissions over an eight-month period.
The case was brought to the attention of the ICAC, who found that some of the shareholders were not aware of Ivan's acceptance of advantages from this supplier, and that the company did not have in place a clear policy on this issue. Some shareholders claimed they had given Ivan permission to accept commissions to subsidise his social expenses in Shanghai and Hong Kong, but they were not able to state when the permission was granted, let alone the approved amount or the circumstances under which the acceptance was permitted.
Under Section 9 of the Prevention of Bribery Ordinance (POBO), the principal's permission (in this case, the toy company) has to be given before an agent (Ivan) solicits or accepts an advantage; otherwise the agent has to apply for permission as soon as reasonably possible after the acceptance. In addition, for such permission to be lawful, the principal needs to carefully consider the details of the application before granting permission.
Ivan's company had not stated clearly in advance whether or not its staff members could accept advantages in relation to their official duties. In other words, Ivan did not have the company's permission when he accepted the commission. Furthermore, since he had not applied for retrospective permission from his company afterwards, and his acceptance of the commission was not known to and approved by all shareholders, such acceptance was considered without the principal’s permission.
Some of the company shareholders recklessly claimed that they had given permission for Ivan to accept commission. However, they had not specified the details and scope of acceptance, and there was no record of the accepted rebates. They also did not take into account the fact that such a policy would affect fairness of competition among their suppliers. This was against both the spirit and requirements of Section 9 of the POBO, so the defence of "permission of the principal" was not substantiated.
As such, companies should proactively formulate rules and regulations to govern the acceptance of advantages by staff at all levels. They should also state clearly in writing the company policy on the nature and maximum amount of advantages staff are permitted to accept, conditions of such acceptance, declaration procedures and enquiry channels, etc. for staff compliance.
Thank you for your feedback.
