Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

5.22

In an investigation, the Commissioner found that a travel agency had contravened

DPP1(1) by requiring its customers to provide their HKID numbers and date of birth when

using its mobile app for online enquiries about the reward points. Having purchased

travel products with the travel agency, customers could join its loyalty programme and

earn reward points. Upon enrolment with the loyalty programme, customers were

assigned with membership numbers. Instead of using the membership numbers to

identify its customers, the travel agency required the customers to key in their HKID

numbers and date of birth for account enquiry or reward points redemption through the

mobile app. The Commissioner rejected the travel agency’s argument that the

collection was necessary for identifying the customers. Furthermore, the Commissioner

found that the travel agency had accepted member enrolment without providing these

items of personal data.

Collection of Personal Data for Direct Marketing Purposes

5.23

In deciding what kinds of personal data are to be collected for direct marketing

purposes, a data user shall comply with the requirements in DPP1(1) to ensure that only

necessary, adequate but not excessive personal data is collected. In this respect, it is still

useful to refer to the views expressed by the Commissioner and the AAB decisions before

the new law came into operation.

The Commissioner considered the names and

contact details of data subjects to be generally sufficient for making a direct marketing

approach.

5.24

In a complaint handled by the Commissioner, telemarketers collected names, gender,

mobile phone numbers, residential addresses and partial HKID numbers from target

customers over the phone by offering them a free medical check-up as an incentive,

and then passed such data to an insurance broker for use in direct marketing. The

Commissioner was of the view that for contact purposes in direct marketing activities,

the collection of the name, phone number and address of a target customer would

suffice. Hence, the insurance broker’s collection of the complainants’ partial HKID

numbers was excessive and in contravention of DPP1(1)(c). However, the insurance

broker might collect the HKID number from a customer after he has agreed to purchase

the insurance product in response to the direct marketing activities.

5.25

While some personal data may be useful to the data user for profiling the customers so

that a target marketing strategy can be adopted for designing and promoting goods,

facilities or services that the customers may be interested in, a data user should refrain

from indiscriminately collecting as much personal data as possible. The data user should

See Investigation Report Number R14-9945, available on the Website.

The Amendment Ordinance imposes stringent requirements on the collection of personal data in direct marketing. The

amendments took effect on 1 April 2013.

See Investigation Report Number R13-1138, available on the Website: