Background
1.The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Allan Chiang published an investigation report today (14 February) on a case concerning the collection of vehicle owners’ personal data from the Register of Vehicles for direct marketing by Imperial Parking (HK) Limited (“Imperial”), which was inconsistent with the purpose of the Register of Vehicles and thus contravened the Data Protection Principles (“DPP”) of the Personal Data (Privacy) Ordinance (“the Ordinance”) on the collection and use of personal data.
2.The facts were that the Complainant received a letter from Imperial promoting monthly parking privileges. The letter contained his name, address and vehicle license plate number. The Complainant then telephoned Imperial to inquire about the source from which it obtained his personal data. He was informed by Imperial that his personal data had been obtained from the Transport Department. The Complainant was dissatisfied that Imperial had collected his personal data from the Transport Department for direct marketing purposes and thus lodged a complaint with the Office of the Privacy Commissioner for Personal Data (“PCPD”).
Findings
Collection of Personal Data Contravened DPP1
3.The PCPD found that Imperial had sent its employee to the Transport Department to collect the data of the Complainant, and the employee had stated in the Application Form for a Certificate of Particulars of Motor Vehicle (“the Application Form”) that the purpose for the application was for “legal proceedings”, but the real purpose was to promote preferential parking rate at Imperial’s Car Park. The Transport Department had reminded applicants to provide true and complete information on the Application Form; otherwise they could be in breach of Section 111(3) of Road Traffic Ordinance. The representation of Imperial, obviously false, contravened DPP1(2), which requires data users to collect personal data by means which are lawful and fair in the circumstances of the case.
Use of Personal Data Contravened DPP3
4.The Commissioner is aware that the regulation concerned has not expressly stated the purpose of establishing the Register of Vehicles. As the relevant provisions for accessing data in the Register of Vehicles are laid down in the Road Traffic Ordinance, the purpose of maintaining the Register of Vehicles should be consistent with the aim of the Road Traffic Ordinance, namely, “to provide for the regulation of road traffic and the use of vehicles and roads (including private roads)…”. The Transport Department has also stated in the Application Form that the personal data in the Register of Vehicles should be used for the purposes of traffic and transport matters.
5.The Complainant originally provided his personal data for registration and licensing of his vehicle and did not know that his personal data would later be used for commercial promotion purpose. As Imperial’s act of using the personal data of car owners for business promotion was unrelated to the purposes of the Road Traffic Ordinance, it fell outside the reasonable expectation of the Complainant.
6.Therefore, without the explicit consent voluntarily given by its customers, the use of customers’ personal data for the promotion of preferential parking rate offered by Imperial’s Car Park has contravened the requirement under DPP3.
The Commissioner’s Comments
7.Mr. Chiang said, “Vehicle owners are one of the most popular target groups for sending direct marketing messages. From the facts of the case, I have reason to believe that many companies engaged in direct marketing activities relating to automobiles may collect vehicle owners’ personal data from the Register of Vehicles of the Transport Department for direct marketing without the consent of data subjects. I hope the publication of this report would serve a deterrent effect on them.”
8.Mr. Chiang further commented, “Under the current legislation, the purpose of establishing the Register of Vehicles is not clear. I am pleased to note that the Transport Department is taking steps to amend the Road Traffic (Registration and Licensing of Vehicles) Regulations to specify the purposes of the Register of Vehicles, which include that the particulars of registered owners would only be released to third parties under specified conditions, including the handling of insurance claims of traffic accidents and car theft cases, conducting any civil and criminal proceedings involving the vehicle concerned, and safety recalls of the vehicles. I hope that the proposals would be implemented earlier so as to effectively protect the personal data privacy of registered vehicle owners.” The Commissioner has given his support to the proposals and expressed his views to the Transport Department. For details, please refer to www.pcpd.org.hk/english/news_events/media_statements/files/TD.pdf.
9.“In general, the use of the personal data kept in public registers is governed by the terms prescribed by the operators of the registers or the relevant ordinance establishing such registers. If data users indiscriminately use personal data retrieved from public registers for direct marketing, they do so at their own peril. Regarding the collection and use of personal data in direct marketing, data users should make reference to the Guidance on the Collection and Use of Personal Data in Direct Marketing issued by the PCPD,” Mr. Chiang concluded.
Collection of the Report
10.For details of the case background, findings, the Commissioner’s recommendations and other comments, please refer to the Report. Copies of the Report can be obtained from the PCPD at 12/F., Sunlight Tower, 248 Queen's Road East, Wan Chai, Hong Kong or downloaded from its website (http://www.pcpd.org.hk/english/enforcement/commissioners_findings/investigation_reports/invest_report.html).
END