Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

personal data is in the data subject’s interest. Lastly, the data user (not just the relevant

person) must also reasonably believe that the use of the data subject’s personal data

for the new purpose is clearly in the data subject’s interest, even if the relevant person

has provided his consent. If any of the foregoing conditions are not met, the data

subject’s personal data should not be used for a new purpose. It would be prudent for a

data user to conduct an assessment on whether the new purpose of use is clearly in the

interest of the data subject, rather than in the business interest of the data user. It is

recommended as good practice for the data user to document the assessment process

and record the factors that it has taken into account. The written assessment is useful for

future reference in handling disputes which may arise.

Part 6A of the Ordinance: Consent for Use or Provision of Personal Data in Direct

Marketing

7.74

Part 6A of the Ordinance (i.e. sections 35A to 35M), which took effect on 1 April 2013,

contains provisions regulating the use and the provision for use of personal data in direct

marketing.

7.75

A data user who intends to use or provide the personal data of a data subject to

another person for use in direct marketing

is required to inform the data subject of

certain prescribed information and to provide the data subject with a response channel

through which the data subject may indicate his consent.

The specific information that

the data user must inform the data subject of prior to obtaining his consent is further

detailed in Chapter 5.

7.76

“Consent” is defined under section 35A(1) of the Ordinance as follows:

consent, in relation to a use of personal data in direct marketing or a provision of personal

data for use in direct marketing, includes an indication of no objection to the use or

provision.

Whilst “consent” for the purpose of Part 6A is defined to include an “indication of no

objection”, silence or no response will not constitute valid consent. The data subject

must have explicitly indicated that he does not object to the use and/or transfer of his

personal data to another person for the purposes of direct marketing.

7.77

One will readily notice that the term “consent” used in Part 6A is different from

“prescribed consent” as used in DPP3(1) and the rest of the Ordinance. Sections 35H

and 35M of the Ordinance expressly acknowledge the difference. Section 35H provides

as follows:

Section 34 of the Ordinance which regulated the use of personal data in direct marketing was repealed.

Part 6A does not apply in relation to the provision of personal data to another for use by that other person in offering or

advertising the availability of social services run, subvented or subsidised by the Social Welfare Department, or

healthcare services provided by the Hospital Authority, the Department of Health or any other social or healthcare

services which, if not provided, is likely to cause serious physical or mental harm to the individual to whom the services

are intended to be provided or any other individual, so long as such provision of personal data is not for gain (section

35I).

Sections 35C and 35J.