Date: 11 December 2017
Comply with Opt-out Requests of Direct Marketing
Respect Consumers’ Personal Data
(11 December 2017) Physical Health Centre Hong Kong Limited (the Company) was convicted today at the Fanling Magistrates' Court of the offence under section 35G(3) of the Personal Data (Privacy) Ordinance (the Ordinance) for failing to comply with the requirement from a data subject to cease to use his personal data in direct marketing. The Company pleaded guilty to the charge and was fined HK$7,000.
Case Background
The case stemmed from a complaint received by the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) in December 2015.
The complainant joined a trial service of the Company in 2011, and provided his personal data, including his name and mobile phone number during registration. After the trial, he did not continue to use the service of the Company. The complainant later received a direct marketing call from the Company in 2013 and he immediately made his opt-out request during the telephone conversation. However, the complainant still received a direct marketing call from the Company in December 2015. Subsequently, the complainant lodged a complaint to the PCPD. The PCPD found that the caller’s phone number was registered by the Company after processing the complaint.
PCPD’s Comments
The Privacy Commissioner for Personal Data, Hong Kong (The Privacy Commissioner) Mr Stephen Kai-yi WONG, said, “ No matter whether a customer’s opt-out request in direct marketing is made verbally or in writing, the company must, without charge to the customer, immediately cease to use the personal data concerned for direct marketing upon receipt of such notification. To ensure that all its staff members comply with the requirements under the Ordinance, the company should have standing procedures, along with appropriate training, for its staff members to follow in regard to accessing and updating the Opt-Out List and complying with the customer’s opt-out requests.”
The Privacy Commissioner also reminded consumers about their opt-out rights against unwanted direct marketing activities, “If a consumer no longer wishes to receive direct marketing messages (addressing him by name), he should file an opt-out request preferably in writing with the company concerned and keep a copy of it. If he still receives direct marketing messages after making an opt-out request, he should make a record and gather as many details of the direct marketing messages as possible in order to lodge a successful complaint.”
Pursuant to section 35G(3) of the Ordinance, a company which receives a customer’s request for cessation of using his personal data in direct marketing must comply with the request without charge. Failure to comply with the requirement is a criminal offence which is punishable by a fine of up to HK$500,000 and imprisonment of up to 3 years.
The PCPD has published the following publications for organisations and consumers:
For guidance on legal compliance, organisations can refer to the "
Guidance on Direct Marketing"
As for consumers, please refer to:
– End –