The head of Hong Kong's pioneering e-payment operator Octopus Holdings has resigned, the company said Thursday, after it admitted selling the personal data of two million customers to businesses.

The ubiquitous Octopus card has brought cashless payments to many facets of Hong Kong life since its launch in 1997, and provided the model for smart cards used on public transport in cities around the world.

Prudence Chan stepped down as Octopus chief executive after an outcry over the company's violation of customers' privacy, including their contact information.

"I have given tremendous thought to the events over the past few weeks and although it is clear that, while Octopus under my watch has adhered to all laws and regulations, I have decided to tender my resignation," Chan said.

"I believe the current issue could have been better handled and for that, I sincerely apologise to our customers and community," she said in a statement.

Chan had previously denied that the group had sold clients' data to other companies.

But at a public hearing last week, she admitted Octopus had earned 44 million Hong Kong dollars (5.7 million US) by divulging the personal information of 1.97 million customers to six companies since 2006.

She said that she made the erroneous claim earlier because of a lack of information at the time.

Her reversal sparked public fury and triggered calls for a government investigation into Octopus, as well as a review of Hong Kong's regulations against the use of personal data without owners' consent.

Octopus says that 95 percent of people aged between 15 and 65 in Hong Kong, which has a population of seven million, use the card to travel, dine and shop.

The company is owned by a consortium of Hong Kong's public-transport operators, including blue-chip rail operator MTR Corp., which holds a 57 percent stake. MTR is majority-owned by the Hong Kong government.

The Octopus scandal has prompted a pledge by new Privacy Commissioner Allan Chiang to strengthen privacy rules, according to the South China Morning Post.

Under existing law, the sale of personal data for profit without the subject's consent is not a criminal offence, and there is no penalty for misuse of personal data in direct marketing.

Chiang said that legislation was no longer up to public expectation and that the government should make violations of privacy an offence, the report said.