Investigation Report: Beauty Centre Transferring a Client's Personal Data to a Third Party without the Client's Consent

1.    Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Roderick B. Woo published today a report (“the Report”) on the result of an investigation of a complaint case carried out pursuant to section 38(a) of the Personal Data (Privacy) Ordinance (“the Ordinance”).  The case concerned a beauty centre (“Beauty Centre A”) that transferred a client’s personal data to another beauty centre (“Beauty Centre B”) without his consent.

The Complaint

2.    The Complainant purchased three-year membership services from Beauty Centre A.  When the Complainant purchased the services, he provided his personal data to Beauty Centre A.  Therefore, the collection and use of the Complainant’s personal data by Beauty Centre A should be limited to this purpose and any purpose directly related to it.  Later, the Complainant found that Beauty Centre A had transferred his personal to Beauty Centre B without his consent, so he lodged a complaint with the Office of the Privacy Commissioner for Personal Data (“PCPD”).

The Investigation

3.    Beauty Centre A claimed that it moved to another address to continue its services due to renovation.  However, when the Complainant went to the address provided by Beauty Centre A, he found that the operator there was Beauty Centre B.  The PCPD found that Beauty Centre A had signed an agreement with Beauty Centre B, agreeing to sell its equipment, customer data and products to Beauty Centre B in the sum of HK$100,000.  The purpose of transferring customer files to Beauty Centre B by Beauty Centre A was for business transaction.  As this was not directly related to the original purpose of collection, Data Protection Principle (“DPP”) 3 had been contravened.

The Commissioner’s Findings and Decision

4.    After considering the information obtained and the circumstances of the case, the Commissioner believed that Beauty Centre A had contravened DPP3 and served an enforcement notice on the operator of Beauty Centre A, directing it to stop transferring customers’ personal data to a third party under similar circumstances of the case, unless prescribed consent has been obtained from customers, and to devise relevant company policy.

5.    Beauty Centre A has complied with the enforcement notice.

The Commissioner’s Recommendations and Comments

6.    Mr. Woo said, “When beauty services operators (“the operators”) first collect personal data from their customers, the operators can clearly inform their customers that if they are unable to complete the services for the customers, they may consider transferring customers’ data to a third party for provision of the same or similar services.  If the operators have not done so, they must ensure that prescribed consent has been obtained before transferring customers’ personal data to a third party in future; otherwise DPP3 will be contravened.”

7.    Mr. Woo further advised, “If customers do not agree to the transfer, the operators should propose other options and reach an agreement on the deletion or return of the data with its customers.  It is an irresponsible act to transfer the data without customers’ consent, and such act also contravenes the requirements of DPP3.”

8.    For details of the case background, findings, the Commissioner’s recommendations and other comments, please refer to the Report.  Copies of the Report can be obtained from the Commissioner’s Office at 12/F., 248 Queen's Road East, Wan Chai, Hong Kong.  The report is also available for download from his website (http://www.pcpd.org.hk/english/publications/invest_report.html).


END