Date: 10 February 2023
Conviction Secured against a Chinese Medicine Practitioner in a Direct Marketing Case
Privacy Commissioner Welcomes the Court’s Ruling
The Eastern Magistrates’ Court today (10 February) convicted a Chinese medicine practitioner (the Defendant) of two charges of direct marketing offences under the Personal Data (Privacy) Ordinance (PDPO) upon her guilty plea. The Police laid charges earlier in October 2022 under sections 35C(1) and 35F(1) of the PDPO against the Defendant. She pleaded guilty today to the relevant offences, in that in December 2020, she failed to take the necessary actions and obtain the data subject’s consent before using her personal data, which was provided to another clinic, in direct marketing. She also failed to inform the data subject, when using her personal data in direct marketing for the first time, of her right to request not to use her personal data in direct marketing without charge. The Defendant was fined HK$2,000 in respect of each charge, which amounted to HK$4,000 in total. The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-ling welcomed the court’s ruling.
The Privacy Commissioner said, “Prior to carrying out any direct marketing activity of any goods or services, a data user (whether an individual or a public/private organisation) must obtain the consent from the data subject on the intended use of his/her personal data for the said purpose. Moreover, the data user should inform the data subject, when using his/her personal data in direct marketing for the first time, of the data subject’s right to request the data user to cease to use the data in direct marketing without charge. Otherwise, the data user may incur criminal liability.”
Background of the Case
The case originated from a complaint received by the Office of the Privacy Commissioner for Personal Data (PCPD) in December 2020.
The Complainant was a patient of a Chinese medicine clinic (the Clinic). She provided her personal data to the Clinic in 2015. The Defendant also worked at the Clinic as a Chinese medicine practitioner. However, the Complainant has never consulted the Defendant at the Clinic. Thereafter, on 4 December 2020, the Complainant received a WhatsApp message from the Defendant who claimed herself as a former Chinese medicine practitioner at the Clinic. The message contained a photo of the Defendant’s business name card, promoting the Chinese medicine service of the Defendant’s new clinic. The Complainant considered that the Defendant had used her personal data for direct marketing without her consent, thus she lodged a complaint with the PCPD.
As the PCPD considered that the case involved contraventions of the direct marketing offences under the PDPO, the PCPD referred the case to the Police for criminal investigation and consideration of prosecution.
Relevant Statutory Provisions
Section 35C(1) of the PDPO requires a data user who intends to use a data subject’s personal data in direct marketing to take a number of specified actions, including notifying the data subject that the data user intends to so use the personal data; that the data user may not so use the data unless the data user has received the data subject’s consent; the types of personal data that will be used; the classes of goods or services that will be marketed; and a response channel through which the individual can communicate his/her consent.
Pursuant to section 35F(1) of the PDPO, the data user must, when using a data subject’s personal data in direct marketing for the first time, inform the data subject of his/her right to request the data user to cease to so use the data, without charge to the data subject.
Failure to comply with the requirements of section 35C(1) and 35F(1) constitutes a criminal offence. The offender is liable to a fine up to $500,000 and imprisonment for 3 years.
-End-