Q: We are an international consumer goods company. We used to have a sole distributor running retail shops of our brand-name products in Hong Kong. Recently, we have decided to take back and run the retail business directly by ourselves. In this connection, we would like to take over the customers' database with regard to a VIP card promotion run by our former distributor. The question is whether such transfer of customers' database would violate the Personal Data (Privacy) Ordinance ("the Ordinance").
A: Data Protection Principle ("DPP") 3 in Schedule 1 to the Ordinance limits the use of data for the purpose for which such data were to be used at the time of their collection or for a directly related purpose, unless the express and voluntary consent of the data subject has been obtained. It is our understanding that personal data contained in the VIP cardholder database were originally collected by your distributor for providing membership services to the cardholders. In case that, upon the sale of the business as a whole by your distributor, such personal data are transferred to you to enable the continual enjoyment of the services by the members, it would seem to us that the transfer of the data would be for the same purpose for which the data were collected in the first place. On that basis, the transfer of data would be consistent with DPP3. In this respect, you must comply strictly with the requirements of DPP3 in using the data only for the purpose of provision of membership services to the data subjects. Moreover, in order to avoid any misunderstanding from the members, both you and your distributor should, prior to the transfer of business, jointly notify all the members of such transfer of business and the continual provision of VIP membership services by you in place of your distributor.