Receipt of direct marketing materials - importance of identifying the party who sent the materials - section 34
The Complaint
The complainant was a former customer of a bank ("the Bank"). She terminated her account with the Bank and wrote to the Bank demanding it not to send promotional item to her in future. A few months later, the complainant received a credit card application form ("the Form") from a credit card company ("the Company") sharing the same prefix, the same logo and the same address of the Bank. When the complainant complained to the Bank, the Bank explained to her that the Company was a separate entity and according to its understanding, the Company obtained the complainant's particulars through an external vendor, not from the Bank.
Dissatisfied with the Bank's explanation, the complainant complained to the Privacy Commissioner claiming that the Bank had contravened section 34 of the Ordinance by failing to cease using her personal data for direct marketing purposes after her op-out request.
Findings by Privacy Commissioner
The Bank advised that the Company and the Bank were ultimately owned by a holding company, but they were separate entities. The Privacy Commissioner also noted that the Form contained references to the Company only. There was no mention of the name of the Bank at all.
The Privacy Commissioner decided that there was no evidence that the Form was sent from the Bank, hence no prima facie case for contravention of section 34 of the Ordinance. The Privacy Commissioner decided not to carry out an investigation.
The complainant appealed against the Privacy Commissioner's decision.
The Appeal
The Board noted that only the name of the Company appeared on the Form and recipient of the Form was requested to complete and return the Form to the Company. It was clear to the Board that the Form was issued by the Company, not the Bank.
The Board has also considered the search records of the Bank and the Company obtained by the Privacy Commissioner from public registries and was satisfied that the Bank and the Company had always been two separate entities.
There was no evidence that the Bank and the Company were in principal-and-agent relationship; or the Bank had in any way disclosed the complainant's personal data to the Company; or that the Bank was in a position to control the use of information procured by or in possession of the Company.
The Board decided that the Privacy Commissioner was entitled to conclude that there was not a prima facie case of any contravention of the Ordinance that would merit his further investigation. The Privacy Commissioner's decision not to carry out an investigation was not unreasonable, illegitimate or improper.
The AAB Decision
The Appeal was dismissed.
uploaded on web in January 2009