Privacy Commissioner discussed organizations’ collection and use of personal data for direct marketing with a political commentary group

1.    The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Allan Chiang today (30 August) met with representatives of the New Forum to listen to their concerns and recommendations on the collection and use of personal data for direct marketing by organizations.

2.    The Commissioner said after the meeting, “The collection and transfer of customers’ personal data to third parties for direct marketing activities by Octopus group of companies has raised public concern about organizational data users’ collection of personal data for direct marketing purposes.  I understand the public’s concern over this issue.  I will keep in touch with relevant bodies and regulatory agencies to listen to their opinions.  It is hoped that direct marketing activities can be carried out under the legal requirements to protect the personal data privacy of the public.”

3.    During the meeting, representatives of the New Forum expressed that they had studied and analyzed the transfer of customers’ personal data to third parties for direct marketing by organizations in Hong Kong.  Some violations of personal data privacy were found, e.g. the clauses of authorizing the transfer of customers’ personal data are printed in unreasonably small prints on agreements; customers are required to give bundled consent to all the clauses on the use of personal data.  They also gave some recommendations to the Commissioner, e.g. making legislation to regulate the transfer of personal data; raising the penalty for contravention of the Personal Data (Privacy) Ordinance (“the Ordinance”); strengthening the promotion of privacy protection, etc.

4.    The Commissioner told the representatives that the PCPD was handling the Octopus case vigorously and he hoped that the result of the investigation could be released next month.  Moreover, the Commissioner wrote to the Chief Executive of Hong Kong Monetary Authority, the Commissioner of Insurance and the Director-General of Office the Telecommunications Authority on 12 August to draw their attention to the requirements of the Ordinance when personal data are collected and used for direct marketing purposes.  Guidelines and recommendations were also provided in the letter.  This has basically responded to the opinions given by the New Forum.  In addition, the Commissioner has also written to professional marketing bodies to express the same message.  The PCPD will publish a revised guideline on direct marketing to help data users comply with the Ordinance when using personal data for direct marketing activities.

5.    Regarding legislation amendment, the Commissioner agreed with the New Forum’s suggestion of raising the penalty for violation of Data Protection Principles of the Ordinance.  Moreover, the Commissioner wrote to the Secretary for Constitutional and Mainland Affairs on 12 August to request for a wider scope on legislation amendment, including making the sale of customers’ personal data to third parties for direct marketing for profits a criminal offence; and strengthening the regulation of direct marketing activities.  The representatives of the New Forum welcomed the move.

6.    Lastly, the Commissioner told the representatives, “The PCPD will make extra efforts in the education and promotion work to promote the public’s awareness and understanding of the Ordinance.  I remind members of the public that they should be alert to the protection of their personal data privacy when they provide their personal data to others.  Besides, I call for organizations to review their practices of collecting personal data for direct marketing to ensure that their practices comply with the requirements of the Ordinance and personal data are properly safeguarded.”

END