Date: 11 June 2025
A Debt Collection Agency
Convicted of Direct Marketing Offences
Privacy Commissioner Welcomes the Court’s Ruling
The West Kowloon Magistrates’ Court today convicted Credit Base (HK) Limited (the Company) of two charges of direct marketing offences under the Personal Data (Privacy) Ordinance (PDPO). The Company was fined HK$2,500 in respect of each charge, which amounted to HK$5,000 in total. The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-ling, welcomed the court’s ruling.
Earlier in March 2025, the Police laid two charges under sections 35C(1) and 35F(1) of the PDPO against the Company, and the Company pleaded guilty today to the charges. The Police investigation revealed that in November 2023, the Company obtained the data subject’s personal data from the District Court’s filings but failed to take the necessary actions to notify the data subject and obtain his consent before using his personal data in direct marketing for promoting debt collection services. The Company also failed to inform the data subject, when using his personal data in direct marketing for the first time, of his right to request the Company to cease to use his personal data in direct marketing without charge.
The Privacy Commissioner pointed out, “Any organisation that is a data user must obtain consent from a data subject on the intended use of his/her personal data for the purpose of any direct marketing activity of any goods or services. The data user should also inform the data subject, when using his/her personal data in direct marketing for the first time, of the data subject’s right to request the data user to cease to use the data in direct marketing without charge. Otherwise, the organisation may incur criminal liability.”
Background of the Case
The case originated from a complaint received by the Office of the Privacy Commissioner for Personal Data (PCPD) in November 2023.
The complainant received a marketing letter from Credit Base (HK) Limited by post in November 2023. The letter contained the complainant’s Chinese full name and residential address. The complainant called the Company to make enquiries and was told that the Company noted that he had filed a claim with the District Court. Therefore the Company contacted the complainant to see whether he needed its debt collection services. The complainant considered that the Company had used his personal data for direct marketing without his consent. He therefore lodged the complaint with the PCPD.
As the PCPD considered that the case involved contraventions of the direct marketing requirements under the PDPO after making some preliminary enquiries, the PCPD referred the case to the Police for criminal investigation and consideration of prosecution.
Relevant Statutory Provisions
Section 35C(1) of the PDPO requires a data user who intends to use a data subject’s personal data in direct marketing to take a number of specified actions, including notifying the data subject that the data user intends to so use the personal data; that the data user may not so use the data unless the data user has received the data subject’s consent; of the types of personal data that will be used; the classes of goods or services that will be marketed and a response channel through which the data subject can communicate his/her consent.
Pursuant to section 35F(1) of the PDPO, the data user must, when using a data subject’s personal data in direct marketing for the first time, inform the data subject of his/her right to request the data user to cease to so use the data, without charge to the data subject.
Failure to comply with the requirements of section 35C(1) and 35F(1) constitutes a criminal offence. The offender is liable to a fine up to $500,000 and imprisonment for three years.