97 / 192
7.66
The manner in which a data user sought to obtain the data subject’s consent for use of
his personal data for direct marketing was the subject of an investigation.
25
In this case,
the bank entered into an agreement with an insurance company to promote the
insurance products of the latter. The bank transferred selected credit card customers’
personal data to the insurance company. According to the records from the opening of
the accounts, the bank sought customers’ consent to disclose their personal data to any
company (not necessarily members of the same group as the bank) for marketing
purposes. The Commissioner noted that there was only one place for the account
holder to sign in the account opening form. The bank had not given its customers a
choice as to whether they agreed to the transfer of their personal data to an external
company for marketing purposes. The consent given was “bundled” in such a way that
the customer could not give consent to the terms and conditions relating to the
application for the credit card service without also consenting to the use of his personal
data in direct marketing. The Commissioner found, in the circumstances of the case,
that no voluntary consent was obtained from the customers for the provision of their
personal data to the insurance company for use in direct marketing.
7.67
It is also clear that under section 2(3)(b), prescribed consent does not include any
consent which has been withdrawn by notice in writing served to the person to whom
the consent had been given. However, for the avoidance of doubt, acts done pursuant
to the consent before the notice withdrawing such consent is served are not affected.
Hence, it is noted that although prescribed consent is not statutorily required to be given
in writing, written as opposed to verbal notice in withdrawing the consent is required
under this provision for the purpose of clarity and ensuring there is no misunderstanding
on the part of data users.
7.68
Sometimes the data subject does not have sufficient understanding of what is proposed
to him for consent, owing to age or mental incapacity. In cases involving minors and
persons with disabilities, consideration should be given as to whether the person has
“sufficient understanding and intelligence”
26
to enable him to fully understand what is
proposed to him. This concern was addressed by the Amendment Ordinance with
changes made to DPP3 permitting the giving of prescribed consent by a relevant
person on behalf of a data subject in specific circumstances mentioned below.
Prescribed Consent Given by a Relevant Person
7.69
DPP3(2) was introduced by the Amendment Ordinance which provides as follows:
(2) A relevant person in relation to a data subject may, on his or her behalf, give the
prescribed consent required for using his or her personal data for a new purpose if –
(a) the data subject is –
(i) a minor;
25
See Investigation Report No. R11-2853, available on the Website:
https://www.pcpd.org.hk/english/enforcement/commissioners_findings/investigation_reports/files/R11_2853_e.pdf26
This is a test derived from a UK Court decision in
Gillick v West Norfolk and Wisbech Area Health Authority and Another
[1986] AC 112.