Complying with Hong Kong PDPO Direct Marketing Rules and Consent Requirements

Hong Kong PDPO Direct Marketing Rules and Consent

The hong kong direct marketing rules under the Personal Data (Privacy) Ordinance (Cap. 486) impose a two-step obligation on any data user who intends to use personal data for direct marketing. Before sending any promotional communication, the data user must inform the data subject of the intended use and obtain the data subject's consent. This requirement sits separately from the general data protection principles that govern collection, accuracy, retention and security of personal data.

PDPO Direct Marketing Hong Kong: The Statutory Framework

The Personal Data (Privacy) Ordinance (Cap. 486) was amended in 2013 to introduce specific provisions for direct marketing. These provisions are found in sections 35A to 35G of the Ordinance. The amendments created a regime that is stricter than the general data protection principles, which only require that personal data be used for the purpose for which it was collected or a directly related purpose.

Under the direct marketing provisions, a data user must take two distinct steps before using personal data for marketing. First, the data user must provide the data subject with prescribed information about the intended use. Second, the data user must obtain the data subject's consent, which may be given in writing or by any other means that clearly indicates agreement.

The Privacy Commissioner for Personal Data (PCPD) enforces these rules and publishes guidance on compliance. A data subject who suffers damage as a result of a contravention may also bring a civil claim for compensation.

Hong Kong Direct Marketing Consent: The Two-Step Requirement

The consent requirement for direct marketing under the PDPO operates differently from the general consent that applies to data collection. For direct marketing, the data user must:

1. Inform the data subject in writing of: - The intention to use the personal data for direct marketing - The classes of goods, facilities or services to be marketed - The type of personal data to be used (for example, name, contact details, purchase history) - The source of the personal data if it was not collected directly from the data subject - Whether the data user intends to provide the data to a third party for direct marketing, and if so, the classes of persons to whom the data will be transferred

2. Obtain the data subject's consent before using the data. The consent must be freely given and specific to the direct marketing purpose. Silence or inaction does not constitute consent.

The data user must retain a record of the consent given. The burden of proving that consent was obtained falls on the data user, not the data subject.

Opt-Out Direct Marketing Hong Kong: The Statutory Right to Withdraw

A data subject has the right to require a data user to cease using their personal data for direct marketing at any time. This opt-out right is absolute and must be honoured without charge.

The data user must comply with the opt-out request within a reasonable time after receiving it. The Ordinance does not prescribe a specific deadline, but the PCPD's guidance suggests that compliance within 30 days is generally considered reasonable.

The opt-out right applies regardless of whether the data subject originally gave consent. Even if the data subject agreed to receive marketing communications at the time of data collection, they may later withdraw that consent without giving any reason.

A data user who continues to use personal data for direct marketing after receiving an opt-out request commits an offence and is liable on conviction to a fine of up to HK$500,000 and imprisonment for up to three years.

Personal Information Collection Statement and Direct Marketing

When a data user collects personal data from a data subject, the data user must provide a Personal Information Collection Statement (PICS) at or before the time of collection. The PICS must state the purpose for which the data will be used, including any intention to use it for direct marketing.

If the data user intends to use the data for direct marketing, the PICS should clearly state this intention and describe the classes of goods, facilities or services to be marketed. The PICS should also explain the data subject's right to object to such use.

The PICS requirement is separate from the direct marketing consent requirement. A data user cannot rely on the PICS alone as evidence of consent. The data subject must take a positive step to indicate agreement, such as ticking a box or signing a form.

Relationship with General Data Protection Principles

The direct marketing provisions operate alongside the six data protection principles set out in Schedule 1 of the Ordinance. These principles cover:

• Data Protection Principle 1: Collection of personal data must be for a lawful purpose directly related to the data user's function or activity
• Data Protection Principle 2: Personal data must be accurate and not kept longer than necessary
• Data Protection Principle 3: Personal data must be used for the purpose for which it was collected or a directly related purpose
• Data Protection Principle 4: Data users must take reasonable steps to safeguard personal data from unauthorised access or loss
• Data Protection Principle 5: Data users must be open about their personal data policies and practices
• Data Protection Principle 6: Data subjects have the right to access and correct their personal data

The direct marketing rules are more restrictive than Data Protection Principle 3. Even if a data user could argue that direct marketing is a directly related purpose under Principle 3, the specific provisions of sections 35A to 35G override that general principle. A data user must comply with both the general principles and the specific direct marketing rules.

Enforcement and Penalties

The PCPD may investigate complaints about direct marketing practices and issue enforcement notices requiring compliance. A data user who fails to comply with an enforcement notice commits an offence and is liable on conviction to a fine of up to HK$50,000 and imprisonment for up to two years.

In addition to criminal penalties, a data subject who suffers damage as a result of a contravention may claim compensation from the data user. The court may award damages for injury to feelings as well as for financial loss.

Practical Compliance Steps

A data user who engages in direct marketing should:

• Review all data collection points to ensure that a PICS is provided at or before collection
• Include a clear statement of the intention to use data for direct marketing in the PICS
• Obtain positive consent from the data subject before using any personal data for direct marketing
• Maintain a record of consent for each data subject
• Establish a process for handling opt-out requests promptly and without charge
• Ensure that any third party to whom data is transferred for direct marketing also complies with the Ordinance

The Intellectual Property Department does not administer the PDPO, but trade mark owners who use customer data for marketing should be aware that their marketing activities are regulated by the PDPO independently of any intellectual property rights they hold. Copyright in marketing materials does not affect the data privacy obligations that apply to the use of personal data in those materials.