PCPD News Issue 32

7 / 24

7
PCPD News 私隱專員公署通訊 • Issue no. 32 行業聚焦
Industry Insight
The functions and powers of the Privacy
Commissioner for Personal Data under
the Personal Data (Privacy) Ordinance
in relation to personal data in the eHRSS
include:
• handling complaints of suspected
breaches of the Personal Data
(Privacy) Ordinance and initiating
investigation if necessary;
• carrying out an inspection of the
eHRSS;
• providing guidance on personal data
privacy in relation to the eHRSS to
citizens and healthcare providers;
and
• h a n d l i n g a n y d a t a b r e a c h
notification in relation to the eHRSS.
電訊公司須遵從客戶的拒收直銷訊息要求
Telecommunications Companies Have to Comply with Customers’ Opt-out Requests
投訴人是一間電訊服務供應商的流動電
話用戶。投訴人表示他曾致電該電訊商
作出「拒收直銷訊息」要求，而當時該
電訊商的職員亦在對話中確認會執行該
要求。
然而，投訴人其後收到該電訊商的電子
月結單時發現，隨電郵附上一則酒店的
晚餐優惠廣告。投訴人不滿該電訊商在
他已作出「拒收直銷訊息」的要求下，
仍向他寄發推廣資訊，遂向公署投訴。
該電訊商回應表示，由於他們視隨電
郵附上的橫幅訊息為普通資訊（而非正
式的促銷資訊），故他們於發出該電郵
前，沒有先刪除該廣告。
結果：電訊公司承諾符合條例規定
《個人資料（私隱）條例》第 35A條下的
「直接促銷」是指藉電子郵件或其他形
式的傳訊，向指名特定人士要約提供服
務，或為該等服務進行廣告宣傳。由於
該廣告是為酒店所提供的晚餐優惠進行
宣傳，故公署認為該廣告屬條例第 35A
條下的促銷資訊。就此，除非該電訊商
已遵守條例下有關直接促銷的規定，否
則不可使用投訴人的個人資料傳達該廣
告。
經公署介入後，該電訊商已採取措拖確
保日後不會就已作出「拒收直銷訊息」
要求的客戶，在其賬戶月結單電郵附帶
任何推廣資訊。
The Complainant, a customer of a
telecommunications service provider,
called the company to make an opt-out
request, and a staff member confirmed
that his request would be complied with.
However, the Complainant later found
that an advertisement promoting dinner
specials at a hotel was attached to the
company’s electronic bill. Dissatisfied
with the company’s non-compliance
with his opt-out request, he lodged a
complaint with the PCPD.
The company responded that it treated
the banner ads attached to its email
messages as general information (not
official marketing information), so it
did not delete the advertisement before
sending the email.
Outcome: The telecommunications
company undertook to comply with the
requirements under the Ordinance
Under section 35A of the Personal Data
(Privacy) Ordinance, “direct marketing”
refers to offering or advertising services to
specific persons by name via electronic
mail or other means of communication.
As the advertisement promoted dinner
specials of a hotel, the PCPD considered
it direct marketing information under
section 35A of the Ordinance. Hence,
unless the company had complied with
the direct marketing requirements under
the Ordinance, it could not use the
Complainant’s personal data for delivery
of the advertisement.
After the PCPD's intervention, the
company took steps to ensure that no
marketing information would be attached
to the electronic bills of customers who
made opt-out requests.
個案摘要
Case in Brief
To prepare for the commencement
of operation of the eHRSS in the first
quarter of 2016, PCPD will publish
information leaflets on personal data
privacy in relation to the eHRSS for the
reference of both the citizens and the
healthcare providers. In the meantime,
you may visit the website of the eHealth
Record Office
home/index.html) to understand more
about the eHRSS.