(14 September 2015) A storage service provider, Links International Relocation Limited operated under the trade name "Links Moving", was charged with the offence of using the personal data of a customer in direct marketing without taking specified actions, contrary to section 35C of the Personal Data (Privacy) Ordinance (the "Ordinance") on 7 September 2015 at the Eastern Magistrates' Court. Links Moving pleaded guilty to the charge. Today, it was fined HK$10,000.
Case Background
The case stemmed from a complaint received by the Office of the Privacy Commissioner for Personal Data ("PCPD") in November 2013.
The complainant engaged the storage service of a company ("Company A") and provided his personal data including his name, credit card number, mobile phone number, company email address managed by him and current residential address, to this Company A.
Subsequently, Company A ceased business in Hong Kong; and the business was taken over by Links Moving, a company similarly providing storage service.
In August 2013, Links Moving sent a direct marketing email to the complainant, in which Links Moving addressed the complainant with his name, and a storage service quotation as well as the terms and conditions offered by Links Moving was enclosed. The complainant was not a customer and had no prior dealings with Links Moving, and neither had been informed nor given consent to Links Moving about the use of his personal data for direct marketing. He lodged a complaint to PCPD and the case was subsequently referred to the Police for criminal investigation.
PCPD's Comments
Section 35C of the Ordinance provides that a data user (e.g. a company or an organisation) must provide the following information to the data subject (e.g. individual consumer) orally or in writing before using his personal data in direct marketing:
It is an offence if organisations do not take specified action to notify individual consumers before using the personal data in direct marketing. Failure to comply with this will attract a fine up to HK$500,000 and imprisonment for up to 3 years.
The Privacy Commissioner for Personal Data Mr Stephen Wong commented, "This is the second conviction of the provisions under the new direct marketing regime, following the conviction of another company last week. According to the law, "direct marketing" means the offering or advertising of the availability of goods and services. The last case related to another company failure to comply with the customer's request for terminating the use of his personal data in direct marketing. This case concerns the company's failure to take the specified steps, including obtaining the customer's consent, before using his personal data for the purposes of direct marketing."
Mr Wong added, "I appeal to all companies or organisations, large or small, to comply with the legal requirements and refrain from taking risks of non-compliance. I believe privacy-respectful organisations will enjoy enhanced customers' trust and loyalty, thus creating a win-win situation for both the customers and the organisations."
Mr Wong reminded consumers that, "Organisations are required to notify you and obtain your consent before using your personal data or transferring the data to another person for use in direct marketing activities. Despite the fact that you may have consented to the use of your personal data in direct marketing, organisations must notify you of your opt-out right when using your personal data in this manner for the first time. You may also require them to cease to so use the data at any time."
Consumers and organisations engaging in direct marketing may visit PCPD's website at www.pcpd.org.hk for more information about regulation of direct marketing.
For guidance on legal compliance, organisations should refer to PCPD's "Guidance on Direct Marketing" available at
www.pcpd.org.hk/english/resources_centre/publications/files/GN_DM_e.pdf
PCPD has also revised an Information Leaflet entitled "Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance". This revised information leaflet can be downloaded from PCPD's website at
www.pcpd.org.hk/english/resources_centre/publications/files/opt_out2015_e.pdf
An easy-to-understand infographic "It is Your Choice to Accept or Refuse Direct Marketing" for member of the public is also available at
www.pcpd.org.hk/english/resources_centre/publications/posters_Infographics/files/
DM_infographic_1231_e.pdf
- End -