Date: 27 May 2019
Direct marketing offence admitted: Auction company fined HK$20,000
Artfund International (Hong Kong) Auction Company Limited (Artfund) was convicted of two charges under the Personal Data (Privacy) Ordinance (the Ordinance) today at the Eastern Magistrates’ Court.
The first charge relates to the failure of Artfund to take specified actions and obtain a data subject’s consent before using her personal data in direct marketing, which was in contravention of section 35C of the Ordinance.
The second charge relates to the failure of Artfund to inform the data subject, when using her personal data in direct marketing for the first time, of her right to request not to use her personal data in direct marketing without charge, which was in contravention of section 35F of the Ordinance.
Artfund pleaded guilty to both charges, and was fined HK$20,000 in total (HK$10,000 in respect of each charge).
Case Background
The case stemmed from a complaint received by the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) in November 2017.
In November 2017, the complainant received at her address an auction booklet of Artfund addressed to her full name. She had no previous dealing with Artfund and that was the first time she received direct marketing material from Artfund. No opt-out clause was provided to her on the direct marketing material. She then complained to the PCPD. Having examined the complaint, the Privacy Commissioner for Personal Data (Privacy Commissioner) was of the view that Artfund had misused her personal data, and referred this case to the Police for criminal investigation.
Relevant Statutory Provision
Section 35C of the Ordinance requires data users not to use an individual’s personal data in direct marketing, or transfer such personal data to a third party for its use in direct marketing, without that individual’s consent. In order to obtain valid consent, the data user must notify the individual of the types of personal data that will be used; the classes of goods or services that will be marketed; and a response channel through which the individual can communicate his consent.
Pursuant to section 35F of the Ordinance, the data user must also, when using the data subject’s personal data in direct marketing for the first time, inform the data subject of his right to request the data user to cease to so use the data, without charging the data subject.
The Privacy Commissioner Mr Stephen Kai-yi WONG said, “Organisations should develop and implement relevant privacy policies, procedures and guidelines to ensure that employees having access to and using customers’ personal data are trained in data handling and protection. They must also communicate effectively to their customers the intended use or provision of their personal data for use in direct marketing, and respect the customer's right over such use of their personal data. The support of the senior management is needed to incorporate the core values of the data ethical accountability into corporate governance for gaining their customers’ trust.”
The PCPD has published the following publications for organisations and consumers:
For guidance on legal compliance, organisations can refer to the “
New Guidance on Direct Marketing”;
As for consumers, please refer to:
－End－