Media Statements

A Car Company Convicted of Direct Marketing Offences
Privacy Commissioner Welcomes the Court’s Ruling

The Eastern Magistrates’ Court today convicted Azzurri Automobile Limited (the Company) of four charges of direct marketing offences under the Personal Data (Privacy) Ordinance (PDPO) upon its guilty plea. The Magistrates’ Court fined the Company HK$2,500 in respect of each charge, which amounted to HK$10,000 in total. The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-ling, welcomed the court’s ruling.
 
Earlier in April 2024, the Police laid four charges under sections 35C(1) and 35F(1) of the PDPO against the Company, and the Company pleaded guilty today to the relevant charges. According to the facts of the case, in November 2023, the Company failed to take the necessary actions to notify the two data subjects and obtain their consents before using their personal data, which was obtained from the records of the Transport Department, in direct marketing. The Company also failed to inform the two data subjects, when using their personal data in direct marketing for the first time, of their rights to request the Company not to use their personal data in direct marketing without charge.
 
The Privacy Commissioner said, “Prior to carrying out any direct marketing activity of any goods or services, a data user (whether an individual or an organisation) must obtain the consent from the data subject on the intended use of his/her personal data for the said purpose. Moreover, the data user should inform the data subject, when using his/her personal data in direct marketing for the first time, of the data subject’s right to request the data user to cease to use the data in direct marketing without charge. Otherwise, the data user may incur criminal liability.”
 
Background of the Case
 
The case originated from two complaints received by the Office of the Privacy Commissioner for Personal Data (PCPD) in November 2023.
 
Each of the complainants received a marketing letter from the Company by post on 6 November 2023. The letters contained the complainants’ English names and addresses. Both of the complainants called the Company to make enquiries and were told by the staff of the Company that the Company had collected their personal data from the records of the Transport Department for the purpose of issuing the letters. The complainants considered that the Company had used their personal data for direct marketing without their consents, thus they lodged complaints with the PCPD.
 
As the PCPD considered that the two cases might involve contraventions of the direct marketing requirements under the PDPO, the PCPD referred the cases to the Police for criminal investigation and consideration of prosecution.
 
Relevant Statutory Provisions
 
Section 35C(1) of the PDPO requires a data user who intends to use a data subject’s personal data in direct marketing to take a number of specified actions, including notifying the data subject that the data user intends to so use the personal data; that the data user may not do so unless the data user has received the data subject’s consent; the types of personal data that will be used; the classes of goods or services that will be marketed; and a response channel through which the data subject can communicate his/her consent.
 
Pursuant to section 35F(1) of the PDPO, the data user must, when using a data subject’s personal data in direct marketing for the first time, inform the data subject of his/her right to request the data user to cease to so use the data, without charge to the data subject.
 
Failure to comply with the requirements of section 35C(1) and 35F(1) constitutes a criminal offence. The offender is liable to a fine up to $500,000 and imprisonment for three years.