The Complainant enjoyed the membership of a club which provided beauty and massage services ("the Club") - a beauty and fitness centre later informed the Complainant that the Club had been closed but the Complainant could continue to enjoy part of the services under the membership in the fitness centre - the fitness centre possessed the membership agreement entered into by the Complainant and the Club - the Complainant believed that the Club transferred his personal data to the fitness centre without his consent - whether the act of the Club contravened the Ordinance - sections 37 and 39 of the Ordinance - DPP3
The Complaint
The Complainant joined the membership of the Club, which later informed the Complainant that it had undergone a renovation and moved to another location. Arriving at the location, the Complainant found a beauty and fitness centre in a different name ("the Centre"). Staff of the Centre told the Complainant that the Club had been closed, but the Complainant could continue to enjoy part of the services under the membership in the Centre. Staff of the Centre also showed the Complainant the membership agreement entered into by the Complainant and the Club. The Complainant believed that the transfer of personal data to the Centre by the Club without his consent had contravened the requirements of the Ordinance and therefore lodged a complaint with the Privacy Commissioner.
Findings by the Privacy Commissioner
The Privacy Commissioner opined that the incident was originated from the fact that personal data and documents of the Complainant were transferred to the Centre for continuing of provision of services after the closure of the Club, but the Centre only agreed to provide part of the services under the membership. The Privacy Commissioner considered that the complaint involved the issue of consumers' interests. Moreover, the Complainant claimed that the Club had been closed and there was no information showing that the company which had run the Club ("the Company") still operated relevant business. Furthermore, with regard to the effective use of the Office's limited resources, the Privacy Commissioner decided to refuse to carry out an investigation of the complaint pursuant to section 39. Dissatisfied with the Privacy Commissioner's decision, the complainant made an appeal to the AAB.
The Appeal
The parent company of the Company appointed a representative to attend the hearing. The representative clarified that the Company was still in operation and had never been closed. It only temporarily suspended the provision of services. The Complainant claimed that the focus of the case was not the amount of services obtained from the Centre. The complaint was lodged mainly because the Club had transferred his personal data to the Centre without his consent and such act was inconsistent with the original purpose of data collection. The AAB opined that the Club ceased to operate at the relevant address did not mean that it had been closed. It is not appropriate to solely rely on the representation of the Complainant to conclude that the Club had been closed. The AAB was of the view that if there is prima facie evidence showing that the Club might have contravened the requirements of the Ordinance, the Privacy Commissioner should make further enquiries under section 37 to decide if the party complained against had contravened the requirements of the Ordinance.
The AAB Decision
The AAB allowed the appeal and remit the case to the Privacy Commissioner to continue the investigation.
uploaded on web in September 2010