Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

marketing subjects to which the data subject has consented.

5.108

The requirements under Part 6A regulating the consent (and its withdrawal) of data

subjects for use and provision for use of their personal data in direct marketing will be

examined in Chapter 7. Readers may also refer to the Guidance Note (as revised) issued

by the Commissioner for practical guidance and recommended good practices when

using personal data for direct marketing.

Online Behavioural Tracking

5.109

Website operators or owners often collect information regarding their users’ online

interaction with the websites. Information such as the online user’s identity, display

and/or language preference, web pages visited, items purchased and transactions

performed may be collected and recorded. The information collected is useful to track

the behaviour and preferences of an online user which may be used by the website

operators or owners to build detailed profiles of the users for marketing or advertising

purposes.

5.110

Online behavioural tracking poses privacy risks to online users as very often the users’

information or browsing habits are collected and transferred to other parties without

their knowledge or consent.

5.111

Whether the behavioural information collected from online users constitutes personal

data is judged on a case-by-case basis. Personal data will deem to have been

collected if it is reasonably practicable to ascertain the identity of the individual directly

or indirectly from the behavioural tracking information collected, for instance, the

information contains a unique identifier, such as an account name or number.

5.112

If online tracking information (such as shopping experiences) is determined to be

personal data and it is collected for direct marketing purposes, data users must follow

Part 6A of the Ordinance to obtain consent from data subjects before using their

personal data for direct marketing purposes.

5.113

If online tracking information is collected for other purposes, data users should, in the

interests of transparency and fairness:

• inform the data subjects what information is being collected or tracked by them, the

purpose of collecting the information, how the information is collected (for example,

through cookies), whether the information will be transferred to third parties and, if so,

the classes of such third parties and the purposes of transfer and how long the

information will be kept;

• inform the data subjects whether any third party has been engaged in collecting or

tracking their behavioural information, the purposes and means of collection and the

retention period; and

Section 35D(2).

See

New Guidance Note on Direct Marketing

, available on the Website: