Whether the act or practice of collection of personal data by a telecommunications company (i.e. demand letters issued by solicitors or threat by a telecommunications company to send debt collectors to the property) was necessary or directly related to its function or activity or was excessive - whether improper means had been used in the act or practice of collection of personal data - unnecessary to investigate - DPP1(1), DPP1(2), section 39(2)(d)
The complaint
The telecommunications company sent a demand letter to the complainant chasing for payment of outstanding charges owed by a previous occupier of the property. As the previous occupier had already moved out, the complainant requested the telecommunications company not to send any further demand letter to the property. The telecommunications company requested the complainant to bring along his identity card and address proof to its shop and to sign a declaration for verification purposes; otherwise, debt collectors might attend the property to recover the outstanding charges. The complainant subsequently received 3 demand letters from the telecommunications company's solicitors, addressed to the previous occupier. He complained to the Privacy Commissioner that the telecommunications company had used unfair means to force him to provide his personal data and that the personal data so sought were "excessive" and not "necessary" in the circumstances of the case.
Findings by the Privacy Commissioner
As the telecommunications company's request for personal data was made to the complainant openly, the Privacy Commissioner found that the complainant could decide whether to supply it or not. As a matter of fact, the complainant decided not to supply his personal data to the telecommunications company. The Privacy Commissioner also found that it was not unfair for the telecommunications company to engage debt collectors for collecting bad debt. The Privacy Commissioner decided not to investigate or further investigate the complaint on the ground that any investigation or further investigation was "unnecessary", in reliance on section 39(2)(d) of the Ordinance.
The appeal
Since the complainant claimed that he was the new occupier of the property and had asked the telecommunications company not to send further demand letters to the property, it was not unreasonable for the telecommunications company to ask the complainant to produce his identity card and address proof for verification purposes. The Board considered that the personal data sought by the telecommunications company was directly related to an activity or function of the telecommunications company (i.e. the collection of outstanding charges for a customer), and thus there was no contravention of DPP 1(1)(b). The fact that the telecommunications company could have checked, by some other means, whether the previous occupier is still living in the property does not mean that the personal data so sought is not directly related to its function or activity.
The Board also found that the personal data sought by the telecommunications company was not "excessive", as the requested personal data would be reasonable proof that the complainant was living in the property and thus was able to verify that the previous occupier was no longer residing in the property.
Regarding the complainant's complaint about the telecommunications company's "threat" of the possibility of debt collectors visiting the property to collect the outstanding charges and the telecommunications company instructing its solicitors to send 3 demand letters, addressed to the previous occupier, to the property, the Board considered that the mere sending of demand letters issued by solicitors is neither unlawful nor unfair. Further, after the complainant had provided a written declaration to the telecommunications company, no further action was taken by the telecommunications company at the property to seek to recover the outstanding charges. The Board found that there was insufficient basis to find that the telecommunications company had committed an act or practice of collecting personal data by an unlawful or unfair means, thereby contravening DPP 1(2).
AAB's decision
The appeal was dismissed.