The new provisions on regulation of direct marketing activities and the provision of legal assistance under the Personal Data (Privacy) (Amendment) Ordinance 2012 will come into force on 1 April 2013.
Tighten control over the use of personal data in direct marketing
Over the past five years, the Office of the Privacy Commissioner for Personal Data (PCPD) has received an increasing number of complaints in relation to alleged misuse of personal data in direct marketing. (Table 1).
The new requirements of “notification” and “consent” under the Amendment Ordinance will enhance protection of consumers’ data privacy right against unwanted direct marketing activities. A data user (for example, a direct marketer), before using or transferring the personal data of data subjects to a third party for direct marketing purposes, must notify the data subjects and obtain their consent to such use. Non-response to the notification does not imply consent.
Table 1: Complaints received by the PCPD
|
Year＊ |
Total (cases) |
Cases in relation to direct marketing |
|
2011-12 |
1,507 |
117 |
|
2010-11 |
1,255 |
175 |
|
2009-10 |
1,022 |
70 |
|
2008-09 |
824 |
69 |
|
2007-08 |
834 |
82 |
*from 1 April to 31 March of the following year
Failure to comply with the new provisions, including non-compliance with the data subject’s request to cease to use his/her personal data in direct marketing , is a criminal offence punishable by a fine of up to HK$500,000 and imprisonment for up to 3 years. If the data is provided to a third party for its use in direct marketing in exchange for gain, non-compliance may result in a maximum penalty of a fine of HK$1 million and 5 years' imprisonment.
Data users may apply the “grandfathering arrangement” to the existing personal data they have been holding for direct marketing purpose before 1 April 2013 provided that the following conditions are met. Under this arrangement, the data user can continue to use the personal data in direct marketing of the same class of products/services it had previously promoted to the data subjects, without having to give notification and obtain consent from the data subjects. The conditions are:
1) the data subject had been explicitly informed by the data user, in a manner which is easily understandable and (if informed in writing) easily readable, of the intended use or use of the data subject’s personal data in direct marketing in relation to a class of products/services;
2) the data user had so used any of the data for that class of products/services, and the data subject had not required the data user to cease to use any of the data; and
3) the data user had not contravened any provision of the Ordinance in force at the time of the use of the data.
The grandfathering arrangement does not apply in the following situations: -
(a) if the data user uses the personal data to promote to the data subject a different class of products/services (this does not meet condition 2);
(b) when a data user collects personal data from customers through a service application form which is designed in such a way that renders it impracticable for its customers to refuse the use of their personal data for direct marketing purposes unrelated to the services the customers seek (i.e. under a "bundled consent” situation), such collection of personal data may be deemed an unfair collection of personal data, and hence a contravention of Data Protection Principle 1 of the Ordinance (this does not meet condition 3); and
(c) the transfer of personal data to another person for use in direct marketing.
Mr. Allan Chiang, the Privacy Commissioner for Personal Data appeals to corporate data users to take action to ensure compliance with the new provisions:
“I trust that under the new regulatory regime, direct marketing activities will be conducted in a more customer-focused and privacy-respectful manner. This is conducive to building customer trust, and enhancing the professionalism of the industry as well as the effectiveness of direct marketing, thus leading to a win-win outcome for both corporate data-users and the consumers,” Mr. Chiang remarked.
Data users who want to learn more about the requirements under the new direct marketing regulatory regime can read “New Guidance on Direct Marketing” , and attend the PCPD’s professional workshops designed to help data users familiarise with the new provisions and compliance measures. Data subjects may read the leaflet “Exercising Your Right of Consent to and Opt-out from Direct Marketing” for understanding of their data privacy rights and join free public seminars organised by the PCPD.
Legal Assistance for Civil Claims
Under the Amendment Ordinance, a Legal Assistance Scheme(section 66(B) will be implemented with effect from 1 April 2013. The scheme is aimed to assist those persons aggrieved by personal data privacy intrusions to seek compensation from the data user for damage, including injury to feelings.
The legal assistance may take the form of legal advice, mediation and legal representation in court. The Commissioner, in exercising his discretion to approve an application for legal assistance, may consider factors which include: the merits of the case; whether the case raises a question of principle and would establish useful legal precedents; whether it is unreasonable to expect the applicant to deal with the case unaided having regard to the complexity of the case (e.g. the applicant is an individual whilst the prospective defendant is a large corporation).
For details, please read the leaflet “Legal Assistance for Civil Claims under the Personal Data (Privacy) Ordinance”.
Obtain a copy of the Guidance Note and Leaflet:
PCPD’s office at 12/F, Sunlight Tower, 248 Queens Road, Wanchai, Hong Kong, or download from http://www.pcpd.org.hk/.
- End -