Case Notes

The use of contact person information on a company’s website for direct marketing

The Enquiry

Enquired whether publicly available information (such as contact person information found on a company’s website) could be used for direct marketing to that company, and whether such act would be considered “direct marketing” activities.

Our Response

All data users (irrespective of corporations or individuals) should comply with the requirements for direct marketing under part 6A of the Ordinance when using personal data for direct marketing (the offering, or advertising of the availability, of goods, facilities or services, to specific persons), including taking the specified actions in section 35C of the Ordinance and obtaining consent from the data subject in accordance with section 35E of the Ordinance before using his personal data for direct marketing purposes.

Generally speaking, if an individual’s office telephone number or email address, obtained from public means like name cards or company websites, can be combined with their name to directly or indirectly identify them, such information could be considered personal data. It is common for the holder of a certain post or job title (e.g. purchasing manager) in a corporation to be approached by a direct marketer at his office telephone or address for selling products or services targeted at the corporation (e.g. photocopying machines or photocopying services) or targeted at him personally. In these circumstances, whether the Commissioner will enforce the provisions in Part 6A of the Ordinance depends on:–

1. the circumstances under which the personal data is collected, for example, whether the personal data concerned is collected in the individual’s official capacity;
2. the nature of the products or services, that is, whether they are for the use of the corporation or personal use; and
3. where the products or services can cater for either use of the corporation or personal use, whether the marketing is targeted at the corporation or the individual.

In clear-cut cases where the personal data is collected from individuals in their official capacities and the product or service is clearly meant for the exclusive use of the corporation, it generally would not be appropriate to enforce the provisions in Part 6A of the Ordinance. In other cases, data users should comply with the provisions in Part 6A.

Besides, some organisations or professional bodies explicitly state that contact information provided is for business purposes only when compiling staff or member communication records. When using such publicly available information, data users must still adhere to the requirements of Data Protection Principle 3 of Schedule 1 to the Ordinance to ensure compliance with the terms of use of the communication records.

(Uploaded in August 2024)