Download Use of Personal Data in Direct Marketing

Use of Personal
Direct Marketing
Data
in
Background
New requirements under the Personal Data (Privacy) (Amendment) Ordinance 2012 (the “Amendment Ordinance”) relating
to direct marketing activities came into effect on 1 April 2013. This article highlights some of the major
provisions in relation to the use and transfer of personal data for direct marketing purposes which will change
the direct marketing practices in Hong Kong.
What is “direct marketing”?
“Direct Marketing” is defined by the Amendment Ordinance as “the offering, or advertising of the availability, of
goods, facilities or services or the solicitation of donations or contributions for charitable, cultural,
philanthropic, recreational, political or other purposes by sending information or goods, addressed to specific
persons by name, by mail, fax, email or other means of communication or by making telephone calls to specific
persons.”
New requirements – notification and consent
If a data user (e.g. a company) intends to use a data subject’s personal data (e.g. name and email address) in
direct marketing, it must provide the data subject with certain prescribed information and obtain his/her consent
before such personal data can be used for such purposes. Therefore, it is best practice to give written
notification to the data subjects on or before the personal data is collected.
The prescribed information includes:1.
The data user intends to use (or provide the personal data to another company) for direct marketing;
2.
The data user must not use or provide the personal data unless the data user has received the data
subject’s consent to the intended use or provision;
3.
The kinds of personal data (e.g. name, email address, telephone numbers) to be used or provided;
4.
The classes of marketing subjects (e.g. cosmetic products) in relation to which the personal data is
to be used;
5.
The classes of persons to which the personal data are to be provided for direct marketing (if
applicable); and
6.
The response channel which is free of charge (e.g. a designated email address, telephone hotline or
postal address) through which the data subject may give their consent.
What constitutes “consent”?
Pursuant to the Amendment Ordinance, “consent” includes an indication of no objection to the use or provision of
the personal data. The data subject must have explicitly indicated that he/she does not object to the use and/or
provision of personal data to others for direct marketing. Therefore, “consent” cannot be inferred from the data
subject’s non-response.
If a data user intends to use the personal data for its own direct marketing, verbal consent of the data subjects
followed by a written confirmation by the data user within 14 days will be sufficient. However, if a data user
intends to provide the personal data to another person or company, written consent of the data subjects is
required.
Opt-out right
When using the personal data for directing marketing for the first time, the data user must notify the data
subjects that they have the right to request the data user to cease to use their personal data for direct
marketing without any charge and such right can be exercised at any time. If a data subject exercises his/her optout right, a data user must comply with such request.
Exemption – pre-existing data
The requirements for a data user to give notification and obtain consent to use the personal data for direct
marketing do not apply to the use of personal data which the data user has control over its use before 1 April
2013 and if all the following conditions are satisfied:1.
The data subject had been explicitly informed by the data user of the intended use or use of the
personal data in direct marketing in relation to a class of products and/or services;
2.
The data user had so used any of the data for that class of products and/or services;
3.
The data subject had not required the data user to cease to use any of the data; and
4.
The data user had not contravened any provision of the Personal Data (Privacy) Ordinance at the time
of the use of the data.
Other exemptions
The requirements relating to the use of personal data in direct marketing do not apply to “the offering, or
advertising of the availability of social services run, subvented or subsidized by the Social Welfare Department;
health care services provided by the Hospital Authority or Department of Health or any other social or health care
services which, if not provided would be likely to cause serious harm to the physical or mental health of an
individual.”
Non-compliance
A data user who fails to comply with the direct marketing provisions under the Amendment Ordinance commits an
offence. For instance, if a data subject fails to notify and obtain consent for using the personal data for direct
marketing is liable on conviction to a fine of HKD 500,000 and imprisonment for 3 years. Non-compliance of the
notification and consent requirements in relation to the provision of personal data for gain will give rise to a
fine of HKD 1 million and imprisonment of 5 years.
Conclusion
In view of the new requirements relating to direct marketing under the Amendment Ordinance, companies shall review
their personal data collection statement and data privacy policy; review the procedures for the collection, use
and transfer of personal data and keep a good record of the relevant actions taken so as to ensure compliance of
the new law.
IMPORTANT:
The law and procedure on this subject are very specialized
and complicated. This article is just a very general outline
for reference and cannot be relied upon as legal advice in
any individual case. If any advice or assistance is needed,
please contact our solicitors.
For enquiries, please contact our Litigation & Dispute Resolution
Department:
E: [email protected]
T: (852) 2810 1212
W: www.onc.hk
F: (852) 2804 6311
Published by ONC Lawyers © 2013