Click here to view the web version
Issue 10, 24 May 2016
What's On
Interview with Privacy Commissioner Mr Stephen Wong
Hong Kong regulator to begin review of data privacy laws - Reuters Financial Regulation 2016 Summit
Hong Kong regulator to begin review of data privacy laws - Reuters Financial Regulation 2016 Summit
A Marketing Company Fined for Using Personal Data in Direct Marketing without Customer's Consent and Failing to Comply with an Opt-out Request
A data user must, without charge to the data subject, cease to use the personal data concerned upon receipt of an opt-out request.
A data user must, without charge to the data subject, cease to use the personal data concerned upon receipt of an opt-out request.
Practical Tips for SMEs - Use Webcams Cautiously to Protect Privacy
Do you know the privacy risks when using webcams? How to stop strangers from watching you through your webcam? Read this article to know more.
Do you know the privacy risks when using webcams? How to stop strangers from watching you through your webcam? Read this article to know more.
Event Reviews
International IT Fest 2016 - Mobile App Development Forum on Privacy and Security
Photos and presentation materials are now available online!
Photos and presentation materials are now available online!
Upcoming Events
Professional Workshops on Data Protection
Some of June 2016 workshops are still open for enrolment!
These professional workshops are tailored to the needs of those people wishing to deepen their knowledge of data protection. Key features include:
Some of June 2016 workshops are still open for enrolment!
These professional workshops are tailored to the needs of those people wishing to deepen their knowledge of data protection. Key features include:
- Analysis of each data protection principle with relevant real-life scenarios
- Codes of Practice and Guidelines
- Updated guidance notes from the PCPD
- Lessons learnt from real cases
- Recommended good practices
DPOC Activity
Share Best Practices with Us!
We encourage members to share their corporate strategies and practices in data protection.
You are most welcome to be one of the guest speakers of our upcoming events, or contribute articles and photos of successful corporate experience.
Share your thoughts with us via dpoc@pcpd.org.hk
We encourage members to share their corporate strategies and practices in data protection.
You are most welcome to be one of the guest speakers of our upcoming events, or contribute articles and photos of successful corporate experience.
Share your thoughts with us via dpoc@pcpd.org.hk
Q. When can a data subject make an opt-out request?
A: A data subject may at any time require a data user to cease to use his/her personal data in direct marketing, irrespective of whether the data is obtained directly from the data subject or not and whether an earlier consent has been given by the data subject to the data user or a third person for such use.
Q. Has a data user contravened the Ordinance by giving the data subject an invalid channel for opting-out or restricting the way and manner that he/she may send the opt-out request?
A: The Ordinance does not require a data user to provide a data subject with a specified channel for opting-out. However, some data users do provide a specified channel for data subjects to opt-out for administrative reasons and/or fostering good customer services. If a data user does not provide an opt-out channel, a data subject may make an opt-out request by the usual means of communication, such as mail, email, telephone call, or paying a visit to the organisation’s business premises.
Q. How to comply with the data subject’s opt-out request effectively?
A: In order to comply with the data subject’s opt-out requirement effectively, data users have to maintain a list of all customers who have indicated that they do not wish to receive further marketing approaches (the “Opt-Out List”). Data users have to adopt a systematic approach to comply with the data subjects’ requests for ceasing such use of their personal data. The Opt-Out List should be updated regularly. Where the list is maintained via an online computer network, individual marketing staff connected to the network have to input new opt-out requests as and when they are received. If the list is distributed other than by a computer network, it is recommended that marketing staff members are notified of the updates at a frequency of no less than once per week. A data user should have standing procedures for its staff to follow in regard to accessing and updating the Opt-Out List and complying with the data subjects’ opt-out requirements.
A: A data subject may at any time require a data user to cease to use his/her personal data in direct marketing, irrespective of whether the data is obtained directly from the data subject or not and whether an earlier consent has been given by the data subject to the data user or a third person for such use.
Q. Has a data user contravened the Ordinance by giving the data subject an invalid channel for opting-out or restricting the way and manner that he/she may send the opt-out request?
A: The Ordinance does not require a data user to provide a data subject with a specified channel for opting-out. However, some data users do provide a specified channel for data subjects to opt-out for administrative reasons and/or fostering good customer services. If a data user does not provide an opt-out channel, a data subject may make an opt-out request by the usual means of communication, such as mail, email, telephone call, or paying a visit to the organisation’s business premises.
Q. How to comply with the data subject’s opt-out request effectively?
A: In order to comply with the data subject’s opt-out requirement effectively, data users have to maintain a list of all customers who have indicated that they do not wish to receive further marketing approaches (the “Opt-Out List”). Data users have to adopt a systematic approach to comply with the data subjects’ requests for ceasing such use of their personal data. The Opt-Out List should be updated regularly. Where the list is maintained via an online computer network, individual marketing staff connected to the network have to input new opt-out requests as and when they are received. If the list is distributed other than by a computer network, it is recommended that marketing staff members are notified of the updates at a frequency of no less than once per week. A data user should have standing procedures for its staff to follow in regard to accessing and updating the Opt-Out List and complying with the data subjects’ opt-out requirements.
Tips on Log-in Information
Understand what precautions to take to protect your user name and password.
Training Updates
Introduction to the Personal Data (Privacy) Ordinance Seminar from Jul - Dec 2016 are now open for enrolment!
Guidance Notes and Information Leaflets
A one stop portal to view all Guidance Notes and Information Leaflets published by the PCPD.