A mobile telephone company contacted the complainant by phone to try to sell him insurance products. Dissatisfied with the use of his personal data, he complained to the Commissioner, who found that the company had contravened DPP3 of the Ordinance. The appeal related to whether an enforcement notice should be served despite the fact that the company had taken remedial action to remedy the contravention. (AAB Appeal No. 4 of 2011)
The Complaint
The complainant was a customer of a mobile telephone company. He received a telephone call from the company marketing to him insurance products. He suspected that the company had used his personal data without his consent, and therefore lodged a complaint with the Commissioner.
Findings of the Commissioner
The Commissioner investigated the company and found that it had contravened DPP3 of the Ordinance by having used the complainant’s personal data without his prescribed consent. Prior to the Commissioner’s conclusion of his investigation, the company revised its privacy protection policy and personal information collection statement to specify explicitly the purpose of use of its customers’ personal data. The company also signed an undertaking to the Commissioner to ensure compliance with the Ordinance while engaging in direct marketing activities. In view of the measures taken by the company, the Commissioner decided not to issue an enforcement notice against the company. The complainant was dissatisfied with the Commissioner’s decision and appealed to the AAB.
The Appeal
The complainant stated in his grounds for appeal that he had authorized a newspaper to ask the Commissioner about the information and details of his case for a news report, but that the Commissioner had refused to respond. He stated that the Commissioner had also refused to provide the newspaper with a copy of the undertaking signed by the company. The complainant further stated in his grounds of appeal that he had authorized the newspaper to enquire with the company about his case and noted from the news report that the information provided by the company to the newspaper was false. It showed that the company was not remorseful about its act. Hence, the Commissioner should have issued an enforcement notice against it.
The AAB stated that the Commissioner’s decision not to serve an enforcement notice against the company was made pursuant to section 50(1) of the Ordinance after he was satisfied that it was unlikely that the contravention would continue or be repeated in view of the remedial action taken by the company and its undertaking to the Commissioner. In respect of the likelihood of repetition, the AAB opined that the Commissioner’s subjective decision must be supported by objective reasoning in order to be reasonable. The AAB found that it was fair for the Commissioner to take into consideration the circumstances of the contravention, remedial action taken and undertakings given by the company before the Commissioner arrived at his decision. The AAB also reminded that the Commissioner’s subjective assessment should be impartial and should not be affected by other unrelated factors.
The AAB accepted that the Commissioner’s refusal to provide a copy of the undertaking to the newspaper was in compliance with the Commissioner’s secrecy duty under section 46 of the Ordinance, and that the Commissioner did not know what false information had been provided by the company to the newspaper. Also, the AAB found that there was no evidence to show that the Company was not remorseful. The AAB therefore found that the Commissioner’s decision was a fair subjective judgment supported by sufficient reasoning.
The AAB's Decision
The Appeal was dismissed.
uploaded on web in March 2014