Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

35H. Despite section 2(3), where a data user requires, under data protection principle 3, the

prescribed consent of a data subject for using any personal data of the data subject in

direct marketing, the data user is to be taken to have obtained the consent if the data user

has not contravened section 35C, 35E or 35G.

In short, section 35C stipulates the specified actions that must be taken by a data user

before it uses personal data in direct marketing; section 35E prohibits a data user from

using personal data without the data subject’s consent, and section 35G demands a

data user cease using personal data in direct marketing if so required by the data

subject. It must be stressed that the law does not prohibit the use of personal data in

direct marketing but merely sets out what constitutes lawful direct marketing using

personal data. So long as the data user complies with the requirements under those

three provisions, it may use the personal data for direct marketing purposes lawfully.

7.78

A similar provision is found in section 35M of the Ordinance, which relates to the transfer

of personal data from a data user to another for use by that other person in direct

marketing. Section 35M provides as follows:

35M. Despite section 2(3), where a data user requires, under data protection principle 3,

the prescribed consent of a data subject for providing any personal data of the data

subject to another person for use in direct marketing, the data user is to be taken to have

obtained the consent if the data user has not contravened section 35J, 35K or 35L.

Sections 35J, 35K and 35L stipulate the specified actions which must be taken by a data

user before it can provide personal data to a third party for use in direct marketing, and

that such provision of personal data should not be done unless it has obtained the data

subject’s consent, and that the data user must stop providing the personal data to a

third party for use in direct marketing if so required by the data subject.

7.79

If the data user intends to use the data subject’s personal data in direct marketing, the

data user shall provide the data subject with the prescribed information

either orally or

in writing, the data subject’s reply to the data user indicating his consent or no objection

may reciprocally be given either orally or in writing. If the consent or indication of no

objection is given orally, the data user must, before using the personal data in direct

marketing, confirm in writing to the data subject within fourteen days from the date of

receipt of the consent or indication of no objection the following:

• the date of receipt of the consent or indication of no objection;

• the permitted kind of personal data for use in direct marketing; and

• the permitted class of marketing subjects

for use in direct marketing.

7.80

However, where the data user intends to provide the data subject’s personal data

(whether for gain or not) to another person for that person’s use in direct marketing, the

See paragraphs 5.99 and 5.100 of Chapter 5 on what “prescribed information” is required under the Ordinance.

See also footnote 57 in Chapter 5 for the meaning of “marketing subjects”.