A bank convicted of privacy contravention

1.   CITIC Bank International ("CITIC") was convicted of breaching section 34(1)(ii) and section 64(10) of the Personal Data (Privacy) Ordinance ("the Ordinance") yesterday (11 January) in the Shatin Magistrates' Courts. CITIC pleaded guilty and was fined $2,500. Since the commencement of the Ordinance in 1996, this is the second conviction for contravention of the Ordinance due to sending of direct mail despite the complainant's opt-out requests.

Background of the case
2.   The complainant is a customer of CITIC. Since 2008, the complainant had requested CITIC in writing more than once not to send direct mail to her. But CITIC continued to do so. The complainant therefore lodged a complaint with the Office of the Privacy Commissioner for Personal Data ("PCPD").

3.   This was a clear case of contravention of section 34(1)(ii) of the Ordinance, which requires a data user to stop using an individual's personal data for direct marketing purposes upon receipt of an opt-out request. Contravention of section 34 of the Ordinance is an offence under section 64(10) of the Ordinance and an offender is liable on conviction to a fine at $10,000.

4.   The PCPD referred the case to the Police, leading to a successful prosecution.

The PCPD's comments
5.   The Privacy Commissioner for Personal Data Mr. Allan Chiang said, "We fully appreciate the value of direct marketing to marketers and consumers, but stressed that it has to be done in a customer-friendly and privacy- assuring manner. This case is the first conviction for contravention of section 34(1)(ii) this year. Though this case was successfully prosecuted, it is believed that it represented only the tip of an iceberg. There must be many other cases in which the data subjects tolerated unsolicited direct marketing approaches as they did not have time to lodge complaints or did not know how to go about making opt-out requests. It also reflects that the current level of fine is too low to serve a deterrent effect on organizational data users. The PCPD expects that the Administration's legislative amendment proposal of increasing the penalty to $500,000 and imprisonment for 3 years will, upon implementation, generate a greater deterrent effect."

6.   To enable the PCPD to follow up a complaint effectively, the PCPD has recently published a leaflet titled "Making an Opt-out Request from Direct Marketing Activities under the Personal Data (Privacy) Ordinance" to assist the public in understanding how to make an opt-out request under the Ordinance and to collect relevant evidence for lodging a complaint if further direct mail or telemarketing call is received.

7.   The leaflet can be downloaded from the website of the PCPD (http://www.pcpd.org.hk/english/publications/files/opt_out_e.pdf) or obtained from its office at 12/F., 248 Queen's Road East, Wan Chai, Hong Kong.