96 / 192
to so much of that act that has been done pursuant to the consent at any time
before the notice is so served).
7.60
There are two important points to note regarding paragraph (a) of the above definition.
First, prescribed consent has to be in an explicit form. In other words, no consent is to be
implied by the data subject’s conduct, silence or omission. However, there is no
requirement for such consent to be in writing,
24
which means that it may be given orally.
For the purpose of obtaining the best evidence, it would be helpful if the prescribed
consent is in writing.
7.61
Prescribed consent should not be deemed to have been given merely by the fact that
the data subject does not respond or object to the giving of such consent. In one
complaint, an estate agent notified its client that he would automatically become a
member of a club operated by the estate agent’s related company (which offered
multifarious services other than estate agency services) if he failed to object. The client
did not respond and as a result the estate agent transferred his personal data to the
club. Since such transfer was not for a purpose directly related to the original purpose of
collection, the prescribed consent of the data subject was needed. The Commissioner
found that the non-response of the data subject could in no way be construed as
consent expressly given within the meaning of “prescribed consent” and, for this reason,
the estate agent was in breach of DPP3(1).
7.62
The other important point to note from section 2(3)(a) of the Ordinance is that
prescribed consent must be “given voluntarily”.
7.63
It is trite law that “consent” obtained by misrepresentation or duress is no consent at all
and thus cannot possibly amount to “prescribed consent”. The Commissioner considers
that by including the element of voluntariness in section 2(3)(a), the legislature intends to
impose a higher standard than merely the absence of misrepresentation or duress.
7.64
With this in mind, in ascertaining whether the consent is voluntarily given, the
Commissioner would give due regard to factors such as disparity of bargaining powers
and whether the data subject is in fact free to choose to give consent or otherwise,
without fear of any adverse consequence. In this connection, “adverse consequence”
may include, for example, the denial to the data subject of any benefit or any service
(especially essential service) by the data user, or the termination of the data subject’s
employment with the data user, if the data subject chooses not to give his consent.
7.65
Hence, a data subject may adduce contrary evidence to show that the consent
purportedly given was not voluntary. The Commissioner will look at all the relevant
evidence and circumstances of the case before deciding whether prescribed consent
was indeed given by the data subject.
24
It should be noted that under Part 6A of the Ordinance, the term “consent” instead of “prescribed consent” is used.
“Consent”, for the purpose of Part 6A relating to use of personal data in direct marketing, includes an indication of no
objection from the data subject.