66 / 192
•
the classes of marketing subjects in relation to which the data is to be used; and
•
the response channel through which the data subject may, without charge by the
data user, communicate the data subject’s consent to the intended provision in
writing.
5.101
The additional notification and consent requirements relating to the transfer of personal
data to another person for use in direct marketing (outlined in paragraph 5.100 above),
do not apply to the transfer of the personal data to the data user’s agent, for the
purposes of carrying out marketing of the data user’s products or services on the data
user’s behalf.
61
The data user’s direct marketing and data transfer notification
obligations under section 35C(2) and DPP1(3) respectively will apply in this case (see
paragraphs 5.65 to 5.90 and 5.99).
5.102
The above information should be presented in a conspicuous manner that is easily
understandable and, if in written form, easily readable. In this regard, a reasonable test
should be adopted in deciding what is easily readable and easily understandable. The
description of marketing subjects and transferees must be sufficiently specific, so as to
enable the data subject to ascertain the goods, facilities or services that will be
marketed and the persons to whom their personal data may be transferred, with a
reasonable degree of certainty. Vague and loose terms such as “marketing goods
and/or services by us, our agents, our subsidiaries, or our partners”, “providing carefully
selected offers, promotions and benefits by us, our subsidiaries, affiliates and/or our
partners”, and “such type of services and products as the company may from time to
time think fit” will fall short of meeting the requirement.
Section 35D(1): Pre-existing Data
5.103
The requirements for a data user to notify the data subject of his intention to use the
latter’s personal data in direct marketing and to obtain the data subject’s consent or
indication of no objection to the intended use under the new regulatory regime takes
effect on a prospective basis.
62
Such notification and consent requirements do not
apply to the use of personal data by a data user for direct marketing purposes
(including the use of the data by the data user’s agent for marketing the data user’s
products or services)
63
in relation to personal data over which the data user had control
before the entry into force of the new provisions (i.e. 1 April 2013) if:
•
the data subject had been explicitly informed by the data user, in a manner which
is easily understandable and (if informed in writing) easily readable of the intended
use of the data subject’s personal data in direct marketing in relation to a class of
marketing subjects;
•
the data user has so used any of the data;
•
the data subject had not required the data user to cease to use any of the data;
61
Section 35I(2).
62
Section 35D(1).
63
Section 35I(2).