1. The Privacy Commissioner for Personal Data (the Commissioner), Mr. Allan Chiang, welcomes the proposed changes made by the Administration to the provisions in the Bill regulating the use of personal data in direct marketing and sale of personal data, as outlined in LegCo Paper No. [LC Paper No. CB(2)1169/11-12(01) (www.legco.gov.hk/yr10-11/english/bc/bc58/papers/bc580224cb2-1169-1-e.pdf)] issued today.
2. “The Bill requires an organisation which intends to use its customer’s personal data for direct marketing or sale to third parties to notify the customer and provide a response facility for the customer to opt-out. I have raised strong objection to the original proposal which allows the organisation to issue the notification at any time after collection of the customer’s personal data, and to treat the customer’s non-response within 30 days as deemed consent. Compared with the provisions of the existing legislation, the original proposal represented a retrograde step in the protection of personal data privacy.” Mr. Chiang said.
3. “I have met most members of the Bills Committee and found that many of them share my concerns. I have also explained in detail our position on this matter to the Administration and the representatives of most of the organisations which had made submissions to the Bills Committee, namely, the Hong Kong Direct Marketing Association, the Hong Kong Federation of Insurers, the Hong Kong Association of Banks, and the Hong Kong Call Centre Association.” Mr. Chiang further said.
4. “I am pleased that the Administration has finally agreed to delete the provisions regarding “delayed notification” and “deemed consent”. Under the new proposal, if an organisation intends to (a) use or provide a customer’s personal data to others for use in direct marketing, or (b) sell a customer’s personal data, he can only do so if (i) he has received a written response from the customer and (ii) there is no objection indicated in the response (“opt-out”); or else it commits an offence.” Mr. Chiang supplemented.
5. “Ideally we prefer that the customer’s reply could take the form of “opt-in” consent rather than “opt-out” consent as presently proposed, as the former respects an individual’s right of self-determination over the collection and use of his personal data. However, as it would take time for the consumer market to adjust to an “opt-in” regime and it is imperative that the Bill is passed in good time to afford greater protection to personal data privacy, I accept the “opt-out” regime as a transitional arrangement.” Mr. Chiang concluded.
END