Provision of a friend’s personal data to a cleaning service company for use in direct marketing – sections 35J and 35K of the Ordinance
The Complaint
Ms A received a direct marketing call from a cleaning service company. The company revealed to Ms A that it was her friend, Ms B, who passed her personal data to them for direct marketing. Ms A was dissatisfied that Ms B had not obtained her consent before providing her personal data to a third party, and therefore lodged a complaint with PCPD.
Outcome
When using personal data of other persons, including friends, we should take into consideration their expectation of personal data protection. Unless the data subject has been notified of the use of his data or the personal data is used for a directly related purpose for which the data was originally collected, we should respect the data subject by obtaining his prescribed consent before using his personal data.
For the use of personal data for direct marketing, a data user must further comply with the requirements under sections 35J and 35K of the Ordinance. A data user who intends to provide personal data of an individual to another person for direct marketing, he must first inform the data subject of his intention to do so, take the specified actions as required by the Ordinance and obtain the data subject’s consent.
Ms A preferred PCPD to handle her complaint by conciliation. Upon PCPD’s intervention, Ms B apologised to Ms A for not obtaining her consent before providing her personal data to the company. Besides, Ms B requested the company to destroy Ms A’s personal data. Ms B also undertook to PCPD that she would not disclose Ms A’s personal data to any third party for use in direct marketing without Ms A’s consent.
(Uploaded in September 2020)