Date: 3 April 2019
An Insurance Agent Convicted of Using Personal Data in Direct Marketing without Consent
An insurance agent (the defendant) was convicted of two charges under the Personal Data (Privacy) Ordinance (the Ordinance) today at the Tuen Mun Magistrates’ Court.
The first charge relates to the offence of using the personal data of a data subject in direct marketing without taking specified actions and obtaining her consent, in contravention of section 35C of the Ordinance.
Another charge relates to the offence of failing to inform the data subject, when using her personal data in direct marketing for the first time, of her right to request not to use her personal data in direct marketing without charge, in contravention of section 35F of the Ordinance.
The defendant pleaded guilty to both charges, and was fined HK$8,000 in total (HK$4,000 in respect of each charge).
Case Background
The case stemmed from a complaint received by the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) in May 2017.
The complainant received a WhatsApp message on her mobile number, addressing her by her surname, from the defendant for promoting a saving plan of the insurance company that the defendant worked for. The complainant said that she did not know the defendant, and questioned how he obtained her surname and telephone number. The defendant failed to provide a satisfactory reply. The complainant then complained to the PCPD. Having examined the complaint, the Privacy Commissioner for Personal Data (Privacy Commissioner) was of the view that the defendant had misused the complainant’s personal data, and referred this case to the Police for criminal investigation.
Relevant Legislative Provision
Section 35C of the Ordinance requires data users (individuals or organisations) not to use an individual’s personal data in direct marketing, or transfer such personal data to a third party for its use in direct marketing, without that individual’s consent. In order to obtain valid consent, the data user must notify the individual of the types of personal data that will be used; the classes of goods or services that will be marketed; and a response channel through which the individual can communicate his consent.
Pursuant to section 35F of the Ordinance, the data user must also, when using the data subject’s personal data in direct marketing for the first time, inform the data subject of his right to request the data user to cease to so use the data, without charging the data subject.
The Privacy Commissioner Mr Stephen Kai-yi WONG said, “With all the different ways of direct marketing available nowadays, the Ordinance provides clear guidance for data users to conduct direct marketing properly for effectively promoting businesses. Data users should also adopt the three data ethics values (i.e. respectful, beneficial and fair) in using customers’ data so as to meet their expectations alongside the requirements of laws and regulations.”
The PCPD has published the following publications for data users and consumers:
As for consumers, they can refer to:
－End－