PCPD - Personal Data Privacy : Guidance on Cross-Marketing activities

Publications and Videos

Personal Data Privacy : Guidance on Cross-Marketing activities

Personal Data Privacy : Guidance on Cross-Marketing Activities

[Image of image]

Introduction

This guidance note serves as a general reference on compliance with the requirements of the Personal Data (Privacy) Ordinance (“the PD(P)O”) in relation to the use of customers’ personal data for the purpose of conducting “cross-marketing” activities. In this context, the term “cross-marketing” refers to the practice whereby:

The personal data of customers (including ex-customers) held by one company “A” are transferred or disclosed to another company “B” for the purpose of conducting activities in the nature of a “joint marketing scheme”;
The joint marketing scheme involves the marketing to those customers products or services of A or B or both, similar or related to those previously or currently provided to them; and
The joint marketing scheme is launched under the joint names of A and B, and is made available exclusively to the customers of A and/or B.

Since the activities of cross-marketing, as referred to above, may result in customers of one company being approached or sent marketing materials by a party previously unknown to them, the use of personal data to carry out such activities may be a matter of particular sensitivity to the individuals concerned. From the point of view of the PD(P)O, the requirements potentially involved are those of data protection principles 1(3) and 3 in Schedule 1 (“DPP1” and “DPP3”) and section 34.

DPP1(3) generally requires a data user, on or before the collection of personal data directly from an individual, to notify such individual of certain matters including the purpose for which the data collected are to be used, and the class of persons (if any) to whom the data may be transferred.

DPP3 requires that personal data shall not, without the prescribed consent of the data subjects, be used for any purpose other than the purposes for which the data were to be used at the time of the collection or a directly related purpose.

Under section 34, the first time a data user uses personal data for the purpose of direct marketing, it shall provide to the individual concerned the option not to receive further any such marketing in the future (hereinafter referred to as an opt-out option .

The following notes are meant to help data users engaged in cross-marketing activities to avoid contravening the relevant requirements of the PD(P)O, as well as to promote good practice in the handling of customers’ personal data in this respect.

Notification to customers of joint marketing scheme

If at the time a company collects the personal data of its customers it already has in mind the carrying out of cross-marketing activities in the future, it should notify the relevant individuals according to DPP1(3) that their data may be used for the purpose of cross-marketing activities, and describe generally the other partner company or companies to whom such data may be transferred. The notification should be given on or before the collection of the data.
On the other hand, if at the time the company collected the data it had no particular cross-marketing activities in mind but subsequently decides to do so, then prior to the transfer of customers’ personal data to a partner company for the purpose of cross-marketing it should consider informing the relevant customers of its intention to do (and reason for doing) so.
As a matter of good practice and to enhance the transparency of any planned joint marketing scheme, a company should consider taking steps to make prior announcement of such scheme to its customers, e.g. by mailings to its customers information leaflet describing the nature and subject of the scheme. This helps to reduce annoyance the customers may feel when they are later approached or sent marketing materials by a partner company previously unknown to them.

Personal Data that may be transferred to joint marketing participants for marketing purpose

A company (“transferor company”) should ensure that any customers’ data transferred to another company (“partner company”) for the purpose of cross-marketing do not exceed what is strictly necessary for the purpose of enabling such activity to be carried out. Typically, the data to be transferred would include contact data, e.g. name, address and telephone number, to enable the partner company to approach the customer.
As an alternative to avoid the need to transfer customers’ personal data to the partner company, the transferor company may consider the option of obtaining the marketing materials from the partner company and carry out the marketing by its own marketing staff. The transfer or disclosure of the customers’ credit card number and/or Hong Kong Identity Card number in full to the partner company should be avoided.

Handling of Customers' Data by Partner Company

There should be a clear comprehensive written agreement between the transferor company and the partner company governing the handling of customers’ data transferred for the purpose of cross- marketing.
In particular, the agreement should provide that the partner company must not use the data for any purpose other than that of the joint marketing scheme. It should also provide for a reasonable period within which the scheme is to be carried out, after which the transferred data or any copies thereof must either be returned to the transferor company or be destroyed.

Providing of Opt-out Option

To comply with the requirements of section 34 of the PD(P)O, the first time the partner company uses a customer’s personal data obtained from the transferor company for the purpose of cross-marketing, it must provide to the customer concerned an option to “opt-out” from such marketing.
To be effective, the partner company that makes the marketing approaches should provide the opt-out option to the customer. If it is a cold-calling approach by telephone, the marketing staff should give an opt-out message such as “If you do not wish to have further marketing calls from us, please tell me and we will not call again”. If the marketing approach is done by mailings to the customer, the marketing material should provide a “tick” box and a return address for the customers to indicate their choice on the opt-out option.
If the customer exercises his/her opt-out option, then the partner company should inform the transferor company about the request made by the customer. The partner company, as well as the transferor company alike, must make no further marketing approaches to the customer using the data obtained from the transferor company.
The partner company, as well as the transferor company, should maintain a list of all individuals who have informed either of them that they do not wish to receive further marketing approaches (the “opt-out” list). The list should be distributed to all staff members of the company who undertake direct marketing activities and the list should be updated to add new opt-outs as and when they are received.

The information provided in this document is for general guidance only. It does not provide an exhaustive guide to the application of the PD(P)O.

March 2004

End of Page

[Annual Report] [Code of Practice/ Guideline & Explanatory Booklet] [Consultation Document/ Report] [Newsletter] [Guidance Note & Fact Sheet] [Leaflet & Form] [Opinion Survey] [Others] [Investigation Report / Inspection Report] [Information Book]

[About PCPD] [The Ordinance] [PCPD Activities] [Information Centre] [Privacy Zone for Youngsters (Games)]
[Publications & Videos] [Enquiries & Complaints] [Case Notes] [Contact Us] [Search] [Site Directory] [Graphical Version]
[Chinese Version]