A bank sending promotional emails for a lucky draw to customers who had opted out of receiving direct marketing communications
The Enquiry
Whether a bank may send lucky draw promotional emails to customers who have opted out of direct marketing.
Our Response
If the promotional email for the lucky draw is addressed to a specific person by his name, and involves the offering or advertising the availability of goods, facilities, or services, the activity may constitute “direct marketing” under the Ordinance. The data user organising such activities should comply with the requirements for direct marketing under Part 6A of the Ordinance, including taking the specified actions as stated in section 35C of the Ordinance and obtaining consent from the data subjects as required in section 35E of the Ordinance before using their personal data in direct marketing.
Regardless of whether a data subject has given prior consent to a data user for the use of personal data in direct marketing, the data subject may, at any time, require the data user to cease using his personal data in direct marketing under section 35G of the Ordinance. Upon receipt of such an opt-out request, the data user shall cease to use the data subject’s personal data for direct marketing.
On the other hand, even if the promotion of the lucky draw does not constitute “direct marketing” under the Ordinance, the data user concerned is still obliged to comply with the requirements under Data Protection Principle 3 of Schedule 1 to the Ordinance, which provides that personal data shall not, without the prescribed consent of the data subject, be used for a new purpose which is not or is unrelated to the original purpose when collecting the data.
(Uploaded in August 2026)