Personal Data Privacy : Guidance on Cross-Marketing Activities

Introduction

This guidance note serves as a general reference on compliance with the requirements of the Personal Data (Privacy) Ordinance (“the PD(P)O”) in relation to the use of customers’ personal data for the purpose of conducting “cross-marketing” activities.  In this context, the term “cross-marketing” refers to the practice whereby:      

• The personal data of customers (including ex-customers) held by one company “A” are transferred or disclosed to another company “B” for the purpose of conducting activities in the nature of a “joint marketing scheme”;
• The joint marketing scheme involves the marketing to those customers products or services of A or B or both, similar or related to those previously or currently provided to them; and
• The joint marketing scheme is launched under the joint names of A and B, and is made available exclusively to the customers of A and/or B.

Since the activities of cross-marketing, as referred to above, may result in customers of one company being approached or sent marketing materials by a party previously unknown to them, the use of personal data to carry out such activities may be a matter of particular sensitivity to the individuals concerned.  From the point of view of the PD(P)O, the requirements potentially involved are those of data protection principles 1(3) and 3 in Schedule 1 (“DPP1” and “DPP3”) and section 34.

DPP3 requires that personal data shall not, without the prescribed consent of the data subjects, be used for any purpose other than the purposes for which the data were to be used at the time of the collection or a directly related purpose.

Under section 34, the first time a data user uses personal data for the purpose of direct marketing, it shall provide to the individual concerned the option not to receive further any such marketing in the future (hereinafter referred to as an opt-out option .

Notification to customers of joint marketing scheme

• If at the time a company collects the personal data of its customers it already has in mind the carrying out of cross-marketing activities in the future, it should notify the relevant individuals according to DPP1(3) that their data may be used for the purpose of cross-marketing activities, and describe generally the other partner company or companies to whom such data may be transferred.  The notification should be given on or before the collection of the data.
• On the other hand, if at the time the company collected the data it had no particular cross-marketing activities in mind but subsequently decides to do so, then prior to the transfer of customers’ personal data to a partner company for the purpose of cross-marketing it should consider informing the relevant customers of its intention to do (and reason for doing) so.
• As a matter of good practice and to enhance the transparency of any planned joint marketing scheme, a company should consider taking steps to make prior announcement of such scheme to its customers, e.g. by mailings to its customers information leaflet describing the nature and subject of the scheme.  This helps to reduce annoyance the customers may feel when they are later approached or sent marketing materials by a partner company previously unknown to them.

Personal Data that may be transferred to joint marketing participants for marketing purpose

• A company (“transferor company”) should ensure that any customers’ data transferred to another company (“partner company”) for the purpose of cross-marketing do not exceed what is strictly necessary for the purpose of enabling such activity to be carried out.  Typically, the data to be transferred would include contact data, e.g. name, address and telephone number, to enable the partner company to approach the customer.
• As an alternative to avoid the need to transfer customers’ personal data to the partner company, the transferor company may consider the option of obtaining the marketing materials from the partner company and carry out the marketing by its own marketing staff.  The transfer or disclosure of the customers’ credit card number and/or Hong Kong Identity Card number in full to the partner company should be avoided.

Handling of Customers' Data by Partner Company

• There should be a clear comprehensive written agreement between the transferor company and the partner company governing the handling of customers’ data transferred for the purpose of cross- marketing.
• In particular, the agreement should provide that the partner company must not use the data for any purpose other than that of the joint marketing scheme.  It should also provide for a reasonable period within which the scheme is to be carried out, after which the transferred data or any copies thereof must either be returned to the transferor company or be destroyed.

Providing of Opt-out Option

• To comply with the requirements of section 34 of the PD(P)O, the first time the partner company uses a customer’s personal data obtained from the transferor company for the purpose of cross-marketing, it must provide to the customer concerned an option to “opt-out” from such marketing.
• To be effective, the partner company that makes the marketing approaches should provide the opt-out option to the customer.  If it is a cold-calling approach by telephone, the marketing staff should give an opt-out message such as “If you do not wish to have further marketing calls from us, please tell me and we will not call again”.  If the marketing approach is done by mailings to the customer, the marketing material should provide a “tick” box and a return address for the customers to indicate their choice on the opt-out option.
• If the customer exercises his/her opt-out option, then the partner company should inform the transferor company about the request made by the customer.  The partner company, as well as the transferor company alike, must make no further marketing approaches to the customer using the data obtained from the transferor company.
• The partner company, as well as the transferor company, should maintain a list of all individuals who have informed either of them that they do not wish to receive further marketing approaches (the “opt-out” list).  The list should be distributed to all staff members of the company who undertake direct marketing activities and the list should be updated to add new opt-outs as and when they are received.

March 2004