Collection and Disclosure of the Personal Data of Lucky Draw Participants
Background
A health products retail company (the “Company”) organised a lucky draw to promote its products. To ensure each participant had only one chance of winning, the Company collected participants' English names and the English letters and first three digits of their Hong Kong Identity (HKID) Card numbers. Winners were required to present their identity documents for verification when collecting their prizes. Subsequently, the Company published a list of winners (the “List”) on its official website and in newspapers. The complainant noticed that the List contained the aforementioned personal data of the winners and lodged a complaint with the PCPD.
Outcome
Upon intervention by the PCPD, the Company confirmed that the List had been removed from its official website and the webpages of the relevant newspapers, and the personal data of all lucky draw participants had been destroyed. Additionally, the Company issued internal guidelines instructing its staff that, for future product promotion lucky draws, participants would only be required to provide the serial numbers of their product purchase receipts. The Company would no longer collect the names and HKID Card numbers of the participants.
Lesson learnt
Lucky draws are a commonly used marketing tool. To protect the interests of participants, while organisers of lucky draw events have legitimate needs to correctly identify winners to ensure prizes are not wrongly distributed, this does not necessarily justify the collection of HKID Card numbers. Relevant organisations should note that they should not collect the HKID Card number of any individual unless the requirements under the PDPO are complied with and the situations specified in the “Code of Practice on the Identity Card Number and Other Personal Identifiers” issued by the PCPD are applicable.
Furthermore, when announcing the winners, event organisers should consider the types of personal data to be disclosed and the extent of disclosure. Data users should take all reasonably practicable steps to ensure that the HKID Card number and the name of the holder are not displayed together publicly.
(Uploaded in April 2025)