Three career representatives of an insurance company made cold calls to the complainant whose name and office telephone number were obtained from the website of the telephone directory of the Hong Kong Government which contained a use restriction clause. The complainant had previously requested the insurance company to put her name in the opt-out list. The complainant lodged a complaint to the Privacy Commissioner that the insurance company was in breach of Data Protection Principle ("DPP") 3 in Schedule 1 of the Personal Data (Privacy) Ordinance ("Ordinance").
Whether the act constituted a contravention of DPP3 in either ways (i) ignoring the opt-out list, and (ii) ignoring the use restriction clause - whether the insurance company is vicariously liable for such contravention - whether the remedial actions taken by the insurance company was sufficient - section 50(1)(a) & (b), 65(2) and DPP3 of the Ordinance.
The Complaint
The Complainant is a civil servant. Notwithstanding the Complainant had previously requested the insurance company to put her name on an "opt-out" list, two career representatives of the insurance company still contacted the Complainant and offered her the company's insurance restructuring service. After the Privacy Commissioner commenced investigation, the insurance company took certain remedial measures to prevent recurrence of such act. However, another career representative still made direct marketing call to the Complainant.
All the three career representatives obtained the Complainant's name and office telephone number ("Data") from the website of the "Telephone Directory of the Government of the HKSAR and Related Organization". The website contains a use restriction clause that stated (i) the information is not intended for direct marketing activities as well as dissemination or circulation of unsolicited publicity or advertising materials, (ii) the advertisers should not used the information to promote their products or services, and (iii) the information contained therein should not be transferred for commercial gain (the "Restriction Clause").
The Complainant was discontented with the practice of the three career representatives who had used the Data for direct marketing purpose despite the Restriction Clause, and hence, lodged this complaint to the Privacy Commissioner.
Findings by Privacy Commissioner
The Privacy Commissioner was of the view that given the Restriction Clause, it should be clear to the three career representatives at the time of searching for and obtaining the Data from the website, that the Data may only be used for facilitation of official communication with the Complainant but not direct marketing purpose. Since the three career representatives had used the Data for purpose unrelated to the original collection purpose and they did not obtain the Complainant's express consent prior to using Data, the Commissioner was of the opinion that the three career representatives had contravened the requirements under DPP3.
Furthermore, the three career representatives failed to consult the opt-out list maintained by the insurance company. The Complainant's name had appeared in the opt-out list of the insurance company since 2005.
Section 65(2) of the Ordinance provides that any act done or practice engaged in by a person as agent for another person with the authority (whether express or implied, and whether precedent or subsequent) of that other person shall be treated as done or engaged in by that other person as well as by him.
The Privacy Commissioner examined the contracts of the three career representatives. They were the agents of the insurance company. The Commissioner was of the view that the cold calling practice of the three career representatives fell within the sphere of employment of class of acts authorized by the insurance company. Even though the contracts provided that the three representatives should observe and comply with all laws, regulations and statutory requirements, it did not mean that the insurance company might evade liability. The Privacy Commissioner was of the view that the insurance company was liable for the contravention of the three career representatives under section 65(2) of the Ordinance.
During investigation, the insurance had adopted various measures to prevent similar incidents from happening. However, the Privacy Commissioner considered that the measures taken were insufficient in that they have not taken into account of a situation where the public domain does not expressly prohibit the use of the personal data for direct marketing but has expressly provided the purpose of disclosure of the data. The Privacy Commissioner considered that even though there was no express prohibition, it did not mean that the personal data so obtained could be used for direct marketing purpose. Therefore, an enforcement was issued to the insurance company. Dissatisfied with the decision, the insurance company appealed to the AAB.
The Appeal
During appeal, the insurance company conceded that the three career representatives were its agents and they were in breach of DPP3. The AAB was of the view that section 65(2) of the Ordinance has a strong flavour of strict liability and it is to ensure that the principal will find some ways to procure observance of the data protection principles. Therefore, the AAB found that the insurance company was vicariously liable as provided under section 65(2) of the Ordinance.
After considering the measures adopted by the insurance company, the AAB also agreed that the measures taken were insufficient because the staff did not accidentally commit the act once, but three times. The AAB was of the view that a clear strong warning should be embedded in a manual or a code of practice to all members of the staff to make them realize that any breach will have serious consequences e.g. a threat for summary dismissal.
However, the AAB considered that the Enforcement Notice goes far beyond rectification of the contravention in question to cover. The AAB did not agree that the breach in the present case arises from the situation where there was no prohibition clause contained in the public domain.
In that light, the AAB set aside the Enforcement Notice and allowed the appeal.
uploaded on web in February 2011