Media Statements

The PCPD Issues “Guidance on the Proper Handling of Customers’ Personal Data for the Beauty Industry”

(26 June 2016)    The Office of the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”) published today the “Guidance on the Proper Handling of Customers’ Personal Data for the Beauty Industry” (the “Guidance Note”) to provide beauty companies with practical guidance on complying with the requirements under the Personal Data (Privacy) Ordinance (the “Ordinance”) in the course of handling customers’ personal data.

In Hong Kong, beauty companies offer a variety of services, and often collect, hold, process and use an enormous amount of customer information at the same time. In view of the unique business features and practices in the beauty industry, this Guidance Note is issued to examine some of those features and practices by way of a “case study”, and set out good practice to comply with the six Data Protection Principles (“DPPs”) under the Ordinance.

The Privacy Commissioner for Personal Data Mr Stephen Kai-yi WONG said, “Major complaints about the beauty and fitness sector received by the PCPD in recent years related to direct marketing, the collection of personal data such as Hong Kong Identity Card number, copy of HKID Card and date of birth, as well as the transfer of customers' personal data to another party without customers' consent. I would like to remind the operators in this trade to comply with the requirements under the direct marketing provisions of the Ordinance. In particular, beauty companies should take specified actions and obtain customers’ consent before using their personal data, and should also follow the opt-out request from the customers in direct marketing. In addition, personal data must be collected in a lawful and fair way, and data collected should be necessary but not excessive. Before disclosing or transferring customers’ personal data to others, beauty companies must ensure the purpose of the disclosure or transfer is not different from the purpose for which the data is originally collected. Otherwise, the customers’ voluntary and express consent should be obtained.”
 
The Guidance Note is based on the knowledge and experience gained from relevant complaints or enquiries that the PCPD has handled. It covers the following six main features and topics:

• Collection of HKID Card number of a customer
• Dishonest / unfair means to extract personal data from customers
• Collection of date of birth of a customer for providing age-specific services and birthday gifts and discounts
• Collection of personal data not connected with the beauty company’s services
• Disclosing or transferring customers’ personal data to others
• Security of personal data collected