Skip to content

Case Notes

Case Notes

This case related to Customer data

Case No.:2008A03

A former customer of a bank, having made her opt-out request to the bank, received direct marketing material sent from a company which she believed to be the bank. Although the bank and the company were ultimately owned by a holding company, they were separate entities. There was not prima facie case against the bank for breach of the Ordinance

Receipt of direct marketing materials - importance of identifying the party who sent the materials - section 34

The Complaint

The complainant was a former customer of a bank ("the Bank"). She terminated her account with the Bank and wrote to the Bank demanding it not to send promotional item to her in future. A few months later, the complainant received a credit card application form ("the Form") from a credit card company ("the Company") sharing the same prefix, the same logo and the same address of the Bank. When the complainant complained to the Bank, the Bank explained to her that the Company was a separate entity and according to its understanding, the Company obtained the complainant's particulars through an external vendor, not from the Bank.

Dissatisfied with the Bank's explanation, the complainant complained to the Privacy Commissioner claiming that the Bank had contravened section 34 of the Ordinance by failing to cease using her personal data for direct marketing purposes after her op-out request.

Findings by Privacy Commissioner

The Bank advised that the Company and the Bank were ultimately owned by a holding company, but they were separate entities. The Privacy Commissioner also noted that the Form contained references to the Company only. There was no mention of the name of the Bank at all.

The Privacy Commissioner decided that there was no evidence that the Form was sent from the Bank, hence no prima facie case for contravention of section 34 of the Ordinance. The Privacy Commissioner decided not to carry out an investigation.

The complainant appealed against the Privacy Commissioner's decision.

The Appeal

The Board noted that only the name of the Company appeared on the Form and recipient of the Form was requested to complete and return the Form to the Company. It was clear to the Board that the Form was issued by the Company, not the Bank.

The Board has also considered the search records of the Bank and the Company obtained by the Privacy Commissioner from public registries and was satisfied that the Bank and the Company had always been two separate entities.

There was no evidence that the Bank and the Company were in principal-and-agent relationship; or the Bank had in any way disclosed the complainant's personal data to the Company; or that the Bank was in a position to control the use of information procured by or in possession of the Company.

The Board decided that the Privacy Commissioner was entitled to conclude that there was not a prima facie case of any contravention of the Ordinance that would merit his further investigation. The Privacy Commissioner's decision not to carry out an investigation was not unreasonable, illegitimate or improper.

The AAB Decision

The Appeal was dismissed.

uploaded on web in January 2009


Category : Provisions/DPPs/COPs/Guidelines : Topic/Subject Matter :