Q: We are a direct-selling company. We provide money-back refunds if a customer is not satisfied with our product. In processing the refund requests, our distributors are requested to submit the returned product along with the Refund Form and a copy of the original Retail Order Form. We would then exchange the returned product with identical replacement product to the distributor. It was suggested that this arrangement might contravene the Personal Data (Privacy) Ordinance ("the Ordinance") in that the Refund Form containing the personal data of the customer was passed to us. The question is whether the distributors can disclose the customers' personal data to us for the purpose of processing refunds.
A: It is our understanding that your distributors collect the personal data of the customers for the purpose of processing refunds to the customers. After refunding, the distributors will in turn seek your replacement of identical products. Before you shall accede to a distributor's request, you would need to verify the existence of a corresponding request made by a customer. As the purposes of collection and the subsequent disclosure by your distributors are "directly related" to each other, we are of the view that there is no contravention of Data Protection Principle ("DPP") 3 in Schedule 1 to the Ordinance. Nevertheless, the distributors should explicitly inform the customers, on or before collecting data, of the purposes for which the data are to be used and the classes of persons the data may be transferred as required under DPP1(3)(b).