The financial institution had used its customers’ personal data for direct marketing (“DM”) in contravention of the Ordinance. However, it subsequently took remedial action and used its customers’ personal data again in compliance with the Ordinance before 1 April 2013.
Q:The financial institution asked the PCPD whether it could rely on section 35D(1) of the Ordinance to use the customers’ personal data for DM after 1 April 2013.
A:To rely on the grandfathering provision under section 35D(1) of the Ordinance, a data user has to show that it had used the personal data for direct marketing prior to 1 April 2013 and that such use had not contravened any provision of the Ordinance as in force as at the time of the use. Given that remedial action had been taken by the financial institution and the second use of the personal data had not contravened the Ordinance as in force as at the time of the use, the PCPD considered that the financial institution could rely on the grandfathering provision under section 35D(1) of the Ordinance.
uploaded in March 2014