Media Statements

KOA International Limited (KOA) was convicted today at the Kwun Tong Magistrates’ Court of the offence under section 35C of the Personal Data (Privacy) Ordinance (the Ordinance) for failing to use the personal data of a customer in direct marketing without taking specified actions and obtaining her consent. KOA pleaded guilty and was fined HK$8,000.
 
Case Background
 
The case stemmed from a complaint received by the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) in June 2017.
 
In February 2017, the complainant registered online as a member of Yoki Magokoro (YM), a beauty product brand run by KOA, by filling in her English full name, telephone number, residential address and office address.  The complainant also opted out of receiving direct marketing materials from YM. On 8 May 2017, the complainant received a mail at her office address about YM’s products. She then complained to the PCPD. Having examined the complaint, the Privacy Commissioner for Personal Data (Privacy Commissioner) was of the view that KOA contravened the requirements for direct marketing under the Ordinance, and referred this case to the Police for criminal investigation.
 
Related Regulation
 
Section 35C of the Ordinance requires data users not to use an individual’s personal data in direct marketing, without that individual’s consent.  In order to obtain valid consent, the data user must notify the individual of the types of personal data that will be used; the classes of goods or services that will be marketed; and a response channel through which the individual can communicate his consent.

The Privacy Commissioner Mr Stephen Kai-yi WONG said, “Of all the business units in Hong Kong, 98% of them (amounting to some 340,000) are small and medium enterprises (SMEs). The SMEs’ compliance with the requirements of the Ordinance, adoption of proactive attitude and measures to protect customers’ personal data, and conducting of direct marketing activities in accordance with the requirements of the Ordinance, play a crucial role in contributing to protection of personal data privacy in Hong Kong.
 
“Ethics, privacy and customer trust has never been more important to all enterprises nowadays, regardless of their business scale. Organisations therefore should abide by higher ethical standards and adopt the data stewardship values (i.e. respectful, beneficial and fair) in handling customers’ data apart from meeting the requirements of laws and regulations. Handling customers' personal data in a lawful and ethical manner is an important aspect of creating mutually beneficial relationship, enhancing goodwill and competitiveness of the enterprises.”
 
The PCPD has published the following publications for organisations and consumers:

• For guidance on legal compliance, organisations can refer to the “New Guidance on Direct Marketing”;
• SMEs can also read the guidance note “Data Protection & Business Facilitation - Guiding Principles for Small and Medium Enterprises” and the information leaflet “Data Ethics for Small and Medium Enterprises”.
• As for consumers, please refer to:
  • Information Leaflet “Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance”
  • An easy-to-understand infographic “It is Your Choice to Accept or Refuse Direct Marketing”