Excessive collection of a customer’s personal data by a beauty centre – DPP1(1)
The Complaint
The Complainant visited a beauty centre for its slimming and whitening treatments, and was required to fill in a registration form for new customers by providing her HKID Card number, date of birth, education level, and occupation. The Complainant was also requested to fill in her HKID Card number in two separate letters of consent for receiving the treatments. Dissatisfied with the beauty centre’s excessive collection of her personal data, the Complainant lodged a complaint with the PCPD.
The beauty centre explained that the purpose of collecting a customer’s HKID Card number in the registration form for new customers was for identity verification. Date of birth was collected for considering and providing follow-up advice and treatment for a customer’s skin, which was age related. By assessing a customer’s education level and occupation, the frontline staff could provide a tailor made presentation to the customer.
The beauty centre further explained that as its business nature was stated as "clinic" in the business licence and the treatments were considered as "high risk procedures" which might be carried out by doctors or therapists, depending on the circumstances, it needed to collect a customer’s HKID Card number in the letters of consent for the beauty treatments. Hence, the doctor-patient relationship was established and it was justified for the beauty centre to collect the HKID Card number of its customers. Furthermore, a customer might claim against the beauty centre for any unsatisfactory treatments, and in order to prove that the content of the letters of consent was read and agreed to, it was necessary to collect the customer’s HKID Card number in the letters of consent.
Outcome
The Commissioner took the view that for the purpose of follow up treatment on a customer’s skin condition, collection of a customer’s birth year would suffice, while the services provided by the beauty centre would not be dependent on a customer’s education level and occupation.
Moreover, the beauty centre could verify a customer’s identity by requesting her to produce any of her other identification documents for the purpose of checking the name and photo, and verify her telephone number on site. The beauty centre could also assign a unique membership number to a customer so as to identify her and locate her records before offering services or treatments to her.
The collection of HKID Card number in the letters of consent for the whitening and slimming treatments on the basis of there being a doctor-patient relationship between the customer and the beauty centre/therapist was misconceived, as the beauty centre was not a clinic registered under the Medical Clinics Ordinance. Moreover, the majority of the treatments were conducted by the therapists of the beauty centre. Certainly, the qualification of therapists was hardly comparable with the training and professional assessment that doctors received, and customers would have trust and confidence in registered doctors’ pre-treatment evaluation, adaptability during treatment or post-treatment follow-up which created the doctor-patient relationship. Hence, HKID Card numbers in the letter of consent could only be collected for the treatments provided by registered doctors and not for the treatments provided by therapists.
In civil actions, the beauty centre as the respondent would not be required to submit the HKID Card number of the plaintiff (i.e. customer who brought the claim action) when preparing its statement of defence.
The Commissioner considered that it was excessive for the beauty centre to compulsorily require customers to (i) provide the HKID Card number, date of birth, education level and occupation in the registration form for new customers and (ii) provide the HKID Card in the letters of consent for the whitening and slimming treatments carried out by persons other than registered doctors. An enforcement notice was served on the beauty centre directing it to take remedial actions. The beauty centre subsequently complied with the enforcement notice.
(Uploaded in September 2016)