1. The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Allan Chiang published today (17 November) an investigation report (“the Report”). The case concerned a telemarketing company (“the Telemarketing Company”) which, under the authorization of a telecommunications company (“the Telecommunications Company”), made a telemarketing call to a customer who had earlier made an opt-out request.
The Complaint
2. The Complainant was a subscriber of the mobile phone network service of the Telecommunications Company. In 2001, the Complainant informed the Telecommunications Company that he did not want to receive any further direct marketing calls, and the Telecommunications Company confirmed to him that it would cease making such call to him.
3. Later on the Complainant received a telemarketing call from the Telemarketing Company representing the Telecommunications Company. Being dissatisfied with the Telecommunications Company’s non-compliance with his previous opt-out request, the Complainant lodged a complaint with the Office of the Privacy Commissioner for Personal Data (“the PCPD”) against the Telecommunications Company.
Provisions of the Ordinance
4. Section 34(1)(ii) of the Personal Data (Privacy) Ordinance (“the Ordinance”) stipulates that if a data user has obtained personal data from any source and uses the data for direct marketing purposes, the data subject may request the data user to cease to so use those data. In such case, the data user shall cease to so use those data without charge to the data subject.
Information Collected during the Investigation
5. According to the agreement between the Telecommunications Company and the Telemarketing Company, the Telemarketing Company would make calls to the mobile phone users in Hong Kong based on random selection to promote the mobile phone network service of the Telecommunications Company.
6. The Telecommunications Company had given the Telemarketing Company the work procedures and guidelines of handling opt-out requests, which required the Telemarketing Company to give the call list generated by random selection to the Telecommunications Company for approval before proceeding with direct marketing. The Telecommunications Company would then delete the phone numbers that had been already opted out from direct marketing of its services before returning the same to the Telemarketing Company for its use. However, the Telemarketing Company had failed to pass the call list used on the incident date to the Telecommunications Company for approval in accordance with the guidelines.
The Commissioner’s Findings
7. The Commissioner is of the view that although the number was generated by random selection by the Telemarketing Company, it was the personal data that the Complainant requested the Telecommunications Company to cease to so use in 2001. Hence, when the Telemarketing Company made the marketing call on behalf of the Telecommunications Company on the incident date, it was contrary to the opt-out request made by the Complainant as the Complainant’s personal data which had been opted out from direct marketing were so used. Section 65(2) of the Ordinance provides that any act done or practice engaged in by a person as agent for another person with the authority of that other person shall be treated as done or engaged in by that other person as well as by him. While the act of the Telemarketing Company had obviously contravened the guidelines of the Telecommunications Company, the Telecommunications Company had also failed to take active measures to ensure that the Telemarketing Company would strictly follow the guidelines. Apparently, this was insufficient to make the Telemarketing Company take serious measures to ensure compliance by its staff. The Commissioner takes the view that the terms in the agreement requiring the Telemarketing Company to comply with the Ordinance and the guidelines of the Telecommunications Company alone were not sufficient to take the act of the Telemarketing Company outside the sphere of acts authorized by the Telecommunications Company. Therefore, the Telecommunications Company was liable for the act of the Telemarketing Company; it had also contravened section 34(1)(ii) of the Ordinance.
The Commissioner’s Decision
8. The Commissioner is of the opinion that the Telecommunications Company’s contravention will likely continue or be repeated. Pursuant to section 50 of the Ordinance, he served an enforcement notice on the Telecommunications Company directing it to clearly specify in the authorization agreements signed between the Telecommunications Company and the companies engaged to conduct direct marketing that the companies are required (i) to pass the call list to the Telecommunications Company for deletion of the phone numbers of customers who have made opt-out requests before using it in direct marketing, (ii) to specify the penalty for violation of the requirement, and (iii) to conduct regular random check on the direct marketing records of the companies.
9. The Telecommunications Company complied with the directions in the enforcement notice in the specified time.
The Commissioner’s Recommendations and Comments
10. Mr. Chiang said, “I understand that direct marketing has its economic value, but it may intrude personal data privacy. To balance the interests of different parties, the Ordinance regulates direct marketing activities in the spirit that direct marketing activities can be carried out effectively in the business society of Hong Kong, while personal data privacy can be protected at the same time.”
11. Mr. Chiang urged, “Commercial organizations have to take all practicable steps to prevent their agents from making direct marketing approaches to those customers who have made opt-out requests, and should select reputable marketing companies that can effectively monitor the performance of frontline staff to ensure that the direct marketing activities comply with the requirements of the Ordinance.”
Collection of the Report
12. For details of the case background, findings, the Commissioner’s recommendations and other comments, please refer to the Report.
13. Copies of the Report can be obtained from the PCPD at 12/F., Sunlight Tower, 248 Queen's Road East, Wan Chai, Hong Kong. The report is also available for download from its website (http://www.pcpd.org.hk/english/enforcement/commissioners_findings/investigation_reports/invest_report.html).
Please click here to access the full Report
END