Date:24 September 2020
Safeguard Your Personal Data Privacy When Participating in Large-scale Lucky Draw Activities
The Office of the Privacy Commissioner for Personal Data (PCPD) noted that a universal lucky draw activity would be conducted by a supermarket chain. Members of the public may register for the lucky draw online or by phone.
The PCPD noted media reports about fraudulent promotional activities allegedly claimed to be conducted by the merchant concerned.
The PCPD reminds members of the public to stay vigilant if the provision of personal data is required when they participate in any promotional activities. They should pay attention to the information released by the organisers in order to ascertain the correct websites or methods for registration; the requisite personal data to be provided; the purposes of collection and the retention period, etc. They should also be aware of phishing websites.
Given that a substantial number of participants may be involved in lucky draw activities organised for the general public,
the PCPD urges merchants to handle personal data prudently when they organise large-scale lucky draw activities to ensure compliance with the provisions of the Personal Data (Privacy) Ordinance. The PCPD would like to highlight the following points in particular:
-
The personal data collected should be necessary but not excessive. The purpose of collection should be directly related to the lucky draw activities. The means of collection should be lawful and fair. Merchants should take practicable steps to inform participants of the purpose(s) of using their data and the classes of persons to whom their data may be transferred, etc.;
-
After the original purpose(s) of the collection of the data has been fulfilled, the personal data collected should be erased as soon as practicable;
-
The use of personal data is restricted to the purpose(s) stated at the time of collection (e.g. to participate in the lucky draw activities) or a directly related purpose. Except with the data subjects’ express and voluntary consent, the data should not be used for other purposes, including the promotion of goods or other activities; and
-
All practicable steps should be taken to protect the personal data against unauthorised or accidental access, processing, erasure, loss or use.
-End-