(30 December 2015) A person was convicted at the Eastern Magistrates’ Court today of the offence of providing personal data to a third party for use in direct marketing without taking specified actions and obtaining his consent, contrary to section 35J of the Personal Data (Privacy) Ordinance (the “Ordinance”). He was fined HK$5,000. Another defendant was charged with the offence of using personal data in direct marketing without taking specified actions, contrary to section 35C of the Ordinance. She was acquitted on the facts of the case, mainly because the Court could not rule out the possibility of her attempting to take those specified actions but was interrupted as the data subject hung up the phone after she mentioned about insurance matters.
Case Background
The case stemmed from a complaint received by the Office of the Privacy Commissioner for Personal Data (“PCPD”) in April 2014. According to the finding of the facts made by the Court, a person who was a real estate agent (“1st Defendant”) obtained the complainant’s Christian name and mobile phone number (“the Data”) in a social function. At that time, the 1st Defendant did not inform the complainant or seek his consent for providing the Data to another party for direct marketing.
About two months later, a person who was an insurance agent (“2nd Defendant”) called the complainant twice on his mobile phone. During the first phone call, the 2nd Defendant identified herself as a financial planner of an insurance company, claiming that the 1st Defendant provided the Data to her. Later, the 2nd Defendant called the complainant again. Once the complainant realised that the 2nd Defendant intended to provide him with information about financial planning and insurance products, he immediately indicated that he had no interest in such products and hung up the phone.
PCPD’s Comments
The direct marketing provisions under the Ordinance require data users (individuals or organisations) not to use an individual’s personal data in direct marketing, or transfer such personal data to a third party for its use in direct marketing, without that individual’s consent. In order to obtain valid consent, the data user must notify the individual of the types of personal data that will be used; the classes of goods or services that will be marketed; and a response channel through which the individual can communicate his/her consent.
If a data user also intends to transfer the personal data to a third party for its use in direct marketing, the data user must notify the individual of the classes of transferees to whom his personal data may be transferred, and whether the personal data will be transferred for gain. Data users should conduct direct marketing activities in a privacy-respectful manner. This is conducive to building trust and enhancing effectiveness of direct marketing.
The Privacy Commissioner for Personal Data Mr Stephen Wong commented, “This is the first conviction of the new offence under section 35J of the Ordinance on the transfer of personal data to a third party for use in direct marketing. The present case reveals the risk of an individual in disclosing personal data obtained in a social function to a third party, knowing that the latter may use it in directing marketing. The direct marketing provisions have to be observed not only by organisational data users, but also by individuals who control the collection, holding, processing or use of personal data. I therefore urge the public to respect privacy and to notify the individuals and obtain their consent before providing the personal data to a third party.”
For guidance on legal compliance, please refer to the following publications:
1) “Guidance on Direct Marketing”
www.pcpd.org.hk/english/resources_centre/publications/files/GN_DM_e.pdf
2) “Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance”
www.pcpd.org.hk/english/resources_centre/publications/files/opt_out2015_e.pdf
3) An easy-to-understand infographic "It is Your Choice to Accept or Refuse Direct Marketing"
www.pcpd.org.hk/english/resources_centre/publications/posters_Infographics/
files/DM_infographic_1231_e.pdf
- End -