PCPD - Privacy Commissioner publishes Guidance on the Collection and Use of Personal Data in Direct Marketing

Date: 18 October 2010

Privacy Commissioner publishes Guidance on the Collection and Use of Personal Data in Direct Marketing

1.    The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Allan Chiang today (18 October) published a Guidance Note, titled “Guidance on the Collection and Use of Personal Data in Direct Marketing” (“the Guidance Note”). The Guidance Note provides data users with practical guidance on compliance with the requirements under the Personal Data (Privacy) Ordinance (“the Ordinance”) while engaging in the collection and use of personal data for direct marketing. It replaces the Fact Sheet on “Guidelines on Cold-Calling” and the Guidance Note on “Cross-Marketing Activities” previously issued by the Commissioner.

2.    Mr. Allan Chiang said, “In view of the recent serious public concern about the mishandling of customers’ personal data by the Octopus group of companies, I have reviewed the existing practices of some direct marketers as regards collection and use (includes transfer) of customers’ personal data; and in the process, identified some common areas for improvement. The Guidance Note represents the fruit of this review and has incorporated, where practicable, the views expressed by some Legislative Council members, industry regulators concerned, different interest groups and business associations of banking, insurance and direct marketing. It provides practical advice with examples to assist marketing practitioners in meeting the minimum legal requirements under the Ordinance. It also draws their attention to recommended good practices for personal data protection.”

3.    “Compared with previous guidance notes we issued in the same area, the Guidance Note is more comprehensive and takes into account more practicing experiences and new developments in the interpretation of the Ordinance. It does not in any way bring about changes in the requirements under the Ordinance. As such, the issue of designating an effective date for the Guidance Note does not arise. However, data users are expected to implement promptly any necessary improvement measures in line with the Guidance Note, albeit I will adopt a pragmatic approach in dealing with complaints by taking into account that a reasonable time has to be allowed for implementing the improvement measures,” Mr. Chiang added.

4.    The Guidance Note covers, among other things, the following:-

(a)    Collection of personal data for direct marketing of products and services has to be related to the original purpose of data collection;
(b)    Personal data should not be excessively collected;
(c)    Data subjects should be informed that it is voluntary for them to supply additional personal data required for direct marketing purposes;
(d)    Collection of personal data should be made by lawful and fair means, avoiding deceptive / misleading means and ‘bundled consent”;
(e)    Personal Information Collection Statement (“PICS”) should be effectively communicated to the data subject, taking into account factors like layout and presentation of PICS, language used etc.;
(f)    “Purpose of use” of personal data and “classes of data transferees” should be defined with a reasonable degree of certainty;
(g)    Recommended good practice for use of personal data collected from public registers for direct marketing;
(h)    Requirements for managing customers’ opt-out requests under section 34(1) of the Ordinance;
(i)    Control of direct marketing activities carried out by agent, contractors or business partners;
(j)    Recommended good practice for the maintenance of an opt-out list;
(k)    Guidance for data user transferring customers’ personal data to a third party (for direct marketing of third party’s products and services) in return for monetary gains.

5.    The Guidance Note can be obtained from the Office of the Privacy Commissioner for Personal Data (“the PCPD”) at 12/F., 248 Queen’s Road East, Wan Chai, Hong Kong, or downloaded from its website, http://www.pcpd.org.hk/english/files/publications/DM_e.pdf.

6.    The PCPD will organize workshops on 8 and 9 November 2010 to assist the direct marketers to better understand the Guidance Note for compliance with the requirements under the Ordinance when they collect and use personal data in direct marketing. The workshops are now open for enrolment. Interested parties may access the PCPD’s website (www.pcpd.org.hk) for further information.

7.    Mr. Allan Chiang said, “Respecting and protecting customers’ personal data privacy is one of the essential factors enabling corporations to win customers’ trust and support. Therefore, I urge the industry to follow the advice in the Guidance Note when collecting and using customers’ personal data for direct marketing. I trust the Octopus incident has the effect of a wake-up call and the Guidance Note will receive the attention of corporations’ top management that it deserves.”

END