Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

false or misleading information to the complainants by describing themselves as

representatives from an “Association” (and omitting the word “Limited”) so as to mislead

target customers to believe that it was a non-profit-making body connected with the

Government. They also falsely claimed that any personal data provided would be

completely destroyed after the medical check-up.

The Commissioner considered that

the use of such misleading or arguably deceitful communication by the data users to

collect personal data had contravened DPP1(2).

5.34

The improper use of personal data mentioned in the preceding paragraph is addressed

with greater regulatory vigour under the new requirements of the Ordinance

which

imposes a duty on the data user to provide prescribed information and obtain the

written consent of the data subjects before the data is provided to a third party for use

in direct marketing. See paragraphs 5.91 and 5.108 below for further details.

Collection of Personal Data through Blind Recruitment Advertisements

5.35

Another example of collecting personal data by unfair means is the use of “blind

advertisements” inviting job applicants to apply for positions without disclosing the

identity of the employer or recruitment agent, resulting in job applicants being lulled into

sending resumes and other personal data to an unknown party.

The situation is worse

where there is in fact no recruitment exercise and the advertisement is placed solely as

a pretext to collect personal data for use in conjunction with other purposes, such as the

compilation of a list of individuals in order to provide it to a third party for carrying out

direct marketing activities. Blind advertisements could also be exploited as an

unscrupulous means to collect personal data for fraudulent activities, thus causing

nuisance or financial loss to the persons affected.

5.36

In light of the acuteness of the problem of blind advertisements, the Commissioner

commenced investigations against advertisers of seventy-one blind advertisements;

forty-eight of the investigations were completed in May 2014 and a report was

published

by the Commissioner in the same month. Some advertisers admitted non-

compliance with DPP1(2), and others explained that they were ignorant of the legal

requirements (which was found by the Commissioner not to be a valid defence).

However, some advertisers argued that the collection of personal data was fair in the

circumstances, as the data user’s identity could be discerned from the abbreviated

version of its name (e.g. its initials) that appeared on the advertisement or from the full

company name incorporated in the return email address. The Commissioner did not

accept this argument as he found that the abbreviated name or email address of the

data user did not provide sufficient and unambiguous information for the data subject

See Investigation Report Number R13-1138, available on the Website:

Section 35J.

See clause 2.3.3 of the Code of Practice on Human Resource Management.

See Investigation Report No. R14-6242, available on the Website: