On 15 January 2013, the Privacy Commissioner for Personal Data released two publications, (1) "New Guidance on Direct Marketing" and (2) a leaflet entitled "Legal Assistance for Civil Claims under the Personal Data (Privacy) Ordinance", which may be relevant to your business.
(1) New Guidance on Direct Marketing
The Guidance provides practical tips to data users on how to comply with the new direct marketing requirements under the amended Personal Data (Privacy) Ordinance ("PDPO"). The new direct marketing provisions will take effect on a date to be announced by the Government but it is tentatively scheduled on 1 April 2013 ("Commencement Date").
The Guidance addresses several hot topics including:
- What is counted as direct marketing activity? Telephone calls to numbers randomly generated are not counted as direct marketing.
- How specific should the description of classes of marketing subjects be? Data users should refer to the distinctive features of the goods, facilities or services so that it is practicable for the customers to ascertain the same with a reasonable degree of certainty.
- What is an "indication of no objection"? Non-response does not constitute consent.
- What is a valid consent? Ticking the box "I do not object to the use of my personal data for direct marketing of XXX" in an application form is a valid consent.
- What is considered as excessive collection of data? "Education level" and "marital status" are unnecessary for the purpose of opening a bank account. Provision of such data should be optional.
- What are deceptive means to collect data? In promoting the product/service of Company A, Company A should not hold out to be Company B to the called party so as to mislead the latter to believe that it is Company B.
- What has to be observed for cross-marketing activities? When a customer requests a company in a cross-marketing scheme to cease using his data, the partner company must also stop using his data in the cross-marketing scheme concerned.
- Grandfathering exception - This applies only to the use of personal data by the data user for its own direct marketing and updates of personal data held by a data user before the Commencement Date. It does not apply to new data acquired after the Commencement Date through (i) updating the data subject's personal profile; and (ii) new business deals with the data subjects.
- Intra-group transfer of personal data – It is a misconception that a data user may freely transfer personal data to its parent company and its subsidiary or associated companies. A data user should not provide personal data to another person for use in direct marketing unless the data subject's written consent is obtained, irrespective of whether any gain is involved.
- Personal data obtained from public registers – Data users need to follow the notification and consent requirements before using such personal data in direct marketing even if such use is not explicitly prohibited by the operators of the public registers.
(2) Leaflet on "Legal Assistance for Civil Claims under the Personal Data (Privacy) Ordinance"
Pursuant to section 66B of the PDPO, the Privacy Commissioner may grant legal assistance to the aggrieved individual who intends to institute proceedings to seek compensation. Application for legal assistance should only be made after a complaint is lodged with the Office of Privacy Commissioner for Personal Data ("PCPD") and a decision is obtained from the Privacy Commissioner.
The complainant bears the responsibility to provide information to support his application and the limitation period for making a claim is normally 6 years from the time when the relevant wrongful act was committed.
Grant and Discontinuance of Legal Assistance
In deciding whether to grant legal assistance, the Privacy Commissioner will consider a number of factors. Among others, the following factors must be considered by the Privacy Commissioner under section 66B(2) of the PDPO:
(a) whether the case raises a question of principle, that is:
- whether the case involves an issue of legal uncertainty which ought to be resolved through legal action;
- whether the case raises grave privacy concern and data protection implications; or
- whether the case would establish useful legal precedents for development of this are of the law;
(b) whether it is unreasonable to expect the applicant to deal with the case unaided having regard to the complexity of the case, or the relative positions between the applicant and other parties to the case (e.g. the applicant is an individual whilst the prospective defendant is a large corporation).
Legal assistance may be provided by the PCPD in the form of legal advice, mediation and legal representation to the assisted person in court. The PCPD may, under certain circumstances, review its decision to grant legal assistance and decide whether to discontinue with providing legal assistance.
There is no right of appeal under the PDPO against the PCPD's decision to refuse to grant or discontinue legal assistance but the Privacy Commissioner may carry out a review of the decision at his discretion.
Legal Fees and Costs
The PCPD will normally bear the costs of providing legal assistance but may not cover the assisted person's liability to pay costs of the defendant or other parties in the legal proceedings if the assisted person has acted in an unreasonable manner leading to an adverse costs order being made against him.
For more details, please refer to the following links:
For further information please contact: