Date: 2 January 2018
Direct Marketing: Customers’ Consent for Data
PARKnSHOP (HK) Limited (the Company) was convicted today at the Tuen Mun Magistrates’ Court of the offence under section 35E(1) of the Personal Data (Privacy) Ordinance (the Ordinance) for using the personal data of a data subject in direct marketing without obtaining the data subject’s consent. The Company pleaded guilty to the charge and was fined HK$3,000. This is the first conviction for the offence of section 35E(1) since the amendment provisions of the Ordinance relating to direct marketing came into effect on 1 April 2013. Section 35E(1) provides that a data user who has complied with section 35C by taking the specified actions (that is informing the data subject his rights and the requisite information) must not use the data subject’s personal data in direct marketing without obtaining his consent.
Case Background
The case stemmed from a complaint received by the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) in January 2016.
The complainant was a registered customer of the online supermarket of the Company and provided his personal data including his email address to the Company for registration. The complainant had never indicated to the Company that he wished to receive any direct marketing materials. In January 2016, the complainant received a direct marketing email from the Company. Subsequently, the complainant lodged a complaint with the PCPD. During the processing of the complaint by the PCPD, the Company has admitted that the complainant had not given consent for receiving its direct marketing materials and the email was accidentally sent to the complainant due to an isolated incident of human error while doing system update.
PCPD’s Comments
The Privacy Commissioner for Personal Data, Hong Kong (The Privacy Commissioner) Mr Stephen Kai-yi WONG said, “The Ordinance does not prohibit direct marketing activities. However, organisations must comply with the requirements of the Ordinance when carrying out direct marketing activities. Organisations must obtain a data subject’s consent before using his personal data in direct marketing. Appropriate training must be provided to its staff members to ensure their awareness of and compliance with the direct marketing provisions under the Ordinance. The conviction once again reminds organisations of such requirements, and at the same time strengthens the culture of respecting personal data privacy within organisations.”
The Privacy Commissioner also reminded consumers about their rights on receiving direct marketing materials, “If a consumer receives direct marketing materials addressing to him from an organisation but he has not indicated his consent to the organisation for receiving its direct marketing materials, he should make a record and gather as many details as possible in order to lodge a complaint.”
Pursuant to section 35E(1) of the Ordinance, a company who has complied with section 35C, must not use personal data in direct marketing without a data subject’s consent. Failure to comply with the requirement is a criminal offence which is punishable by a fine of up to HK$500,000 and imprisonment of up to 3 years.
The PCPD has published the following publications for organisations and consumers:
For guidance on legal compliance, data users can refer to the “
New Guidance on Direct Marketing”
As for consumers, please refer to:
-END-