In 2012 Hong Kong introduced the Personal Data (Privacy)
(Amendment) Ordinance1 (the "Amendments" ) to,
amongst other things, strengthen restrictions on the use of
personal data for direct marketing purposes. The Amendments modify
Hong Kong's 1997 Personal Data (Privacy) Ordinance (the
"PDPO"), and effective April 1, 2013, (i) generally
prohibit the disclosure of personal data without the consent of the
individual from whom such data was collected ("Data
Subject"), (ii) increase the Privacy Commissioner's
enforcement powers under the PDPO, (iii) grant greater data access
rights to Data Subjects, (iv) further regulate processing of
personal data in outsourcing, and (v) include new exemptions to
allow the use, disclosure and/or transfer of personal data in
specified circumstances without contravening the Amendments.
Notably, the Amendments also permit legal assistance in relation to
claims made under the PDPO, criminalize disclosure of personal data
for commercial gain and without consent, and impose certain
restrictions and obligations concerning the outsourcing of data
processing to third parties, some of which were put into operation
in October 2012.
The most critical change arising from the Amendments relates to a
company's ability to engage in direct marketing activities
without opt-in consent. Given the prospect for criminal sanctions,
it is no wonder that many companies have sent a flurry of notices
and messages in various forms to individuals in Hong Kong to secure
compliance. Many businesses have also sought to take advantage of
the grandfathering provision designed to create a smooth entry
point for the new provisions. However, there remains some confusion
and uncertainty as to the appropriate measures that should be taken
to legitimately use personal data for direct marketing activities
in compliance with the new provisions.
What are the Penalties for Non-Compliance?
The Amendments create offences for persons who control or use
personal data ("Data Users") and fail to comply with the
notification, consent and cessation to use such personal data.
Generally, the offences stipulate a maximum fine of HK$500,000 (or
USD$ 64,270) and imprisonment of three years. However, a higher
penalty with a maximum fine of HK$1,000,000 (or USD$ 128,540) and
imprisonment for five years apply where provision of personal data
or failure to cease using the personal data upon request is for
gain2.
For each of the offences created, it is a defence to prove that
the Data User took all reasonable precautions and exercised all due
diligence to avoid the commission of the offence. The burden of
proof is on the Data User and it is also liable for its agent's
contravention of the legislation.
There are also a number of exemptions under the legislation which
exclude certain personal data from the requirements.3
For instance, personal data may be transferred or disclosed by a
Data User for the purpose of a due diligence exercise to be
conducted in connection with business merger, acquisition or
transfer of business upon fulfilment of certain conditions, even
though such purpose was not provided for at the time of collection
of the data.4
What are the New Requirements Applicable to Direct Marketing?
With respect to direct marketing practices, the Amendments
address two types of activities: (a) use of personal data for
direct marketing purposes, and (b) provision of personal data to
third parties for direct marketing purposes. The Amendments impose
very similar requirements on the Data Users for both types of
activities, though there are slight nuances in their application.
Generally, the Amendments regulate companies who are engaged in (a)
the offering or advertising of the availability of goods,
facilities or services; or (b) the solicitation of donations or
contributions for charitable, cultural, philanthropic,
recreational, political or other purposes, through either
(x) sending information or goods, addressed to specific persons
by name, by mail, fax, electronic mail or other means of
communication; or (y) making telephone calls to specific
persons.
Thus, it appears that a direct marketing communication falls under
the Amendments if it (a) constitutes an offering or advertisement
of goods, facilities or services, or solicitation of donations or
contributions, as opposed to mere educational or instructional
communications, or communications concerning an existing business
relationship. Also, such direct marketing communications must be
addressed to a specific person by name. That is,telephone
calls or emails where the recipient's identity is unknown or
sent to a general address will not be subject to these new
regulations, though such communications will still fall under the
ambit of the Unsolicited Electronic Messages Ordinance, Cap 593.
Lastly, the communication must be addressed to the person in his
own personal capacity, as opposed to an official capacity
representing a business or company.
Naturally, whether a particular direct marketing communication is
targeted at an individual or a business will depend on the
particular facts and circumstances of each case. The distinction is
obvious if the goods or services being advertised or offered can
only be for personal consumption. However, there will be
uncertainty under the Amendments where such goods or services can
be consumed by either a business and an individual. For example,
Office of the Privacy Commissioner for Personal Data (the
"Commissioner") has clarified that Business-to-Business
direct marketing communications for office products would probably
not be considered "direct marketing" for the purposes of
the PDPO.5 However, direct marketing communications for
industry training may be less clear, as such services may be
applicable to a business wishing to provide training to its
employees or an individual wishing to supplement his/her personal
credentials. Where such potential ambiguity exists, the identity of
the recipient and form of address used would likely be
considered.
Another potential ambiguity relates to communications that are
educational and informational in nature, but where there is
uncertainty as to whether the predominant purpose and nature of the
communication is the offering or advertising of services or goods.
The Commissioner has not provided any guidance on this point. Until
such guidance is provided, it is advisable to exercise caution and
implement best practices to ensure that such materials do not fall
within the scope of the Amendments.
Who is a 'User' and 'Provider' of Personal Data?
The Amendments clarify that direct marketing activities outsourced to an agent remains the responsibility of the principal. In other words, the principal must ensure that either it or its agent complies with the new provisions. Accordingly, the provision of personal data to a Data User's agent is not recognized as a provision of personal data to third parties.6 However, this should not be confused with the transfer of personal data to related entities (e.g., parent or affiliated companies) who do not act as agents. Such transfers may still fall under the provisions regulating the transfer of personal data to third parties for direct marketing purposes.7 Basically, a Data User may not provide such personal data to a third party for use in direct marketing unless it has already provided the prescribed information and response channel to the Data Subject and received a reply from the same indicating that he or she consents or does not object to the Data User doing so8.
Am I Protected Under the Grandfathering Provision?
The Amendments contain grandfathering provisions that allow Data Users to continue using personal data in their control prior to April 1, 2013 without the need to comply with the new consent and other requirements. However, to qualify, the following conditions must be satisfied, in relevant part:9
- prior to April 1, 2013, the Data Subject was explicitly informed in writing of the intended or actual use of personal data in direct marketing with reference to the direct marketing subject (i.e., the class of goods, facilities or services, or purpose for which donations or contributions were solicited);
- the Data User used any of the personal data as communicated to the Data Subject;
- the Data Subject had not required the Data User to cease such use of the personal data; and
- the Data User had not contravened any provision of the PDPO at the time of such use.
Data Users may take advantage of the grandfathering provisions
to avoid disruption to their direct marketing practices, provided
the above conditions have been satisfied. We recommend conducting a
review of the exact nature of personal data provided by Data
Subjects prior to April 1, 2013 to assess whether previous notices
given and data usage can satisfy the grandfathering provision. For
instance, Data Users should review existing consents to determine
if Data Subjects are adequately informed of the intended use of
their personal data for direct marketing, and determine if Data
Subjects were provided an option to unsubscribe or opt-out of the
direct marketing activities. Note that any notices provided after
April 1, 2013 will not qualify for the grandfathering provisions -
these are too late to sanitize any non-compliance.
It is important to note that the grandfathering provision only
applies if the personal data is used in the same manner as
described to the Data Subject. If the personal data is being used
in direct marketing for a class of goods or services (i.e., market
subject) that was not previously communicated to the Data Subject,
the Data User would need to comply with the new provisions, and
will not be eligible for the grandfathering arrangement.
What if the Data is Collected by Third Parties?
Under the Amendments, a Data User does not need to obtain consent from Data Subjects if their personal data is provided to the Data User by a third party, and that third party has, by written notice:
- stated that it has complied with the relevant provisions informing the Data Subject of the intended transfer of personal data and obtaining written consent in relation to the transfer; and
- specified the class of marketing subjects in relation to which the personal data may be used in direct marketing by the Data User.
In effect, either the Data User making actual use of the personal data for direct marketing or the third party who transfers the personal data to the Data User must comply with the new provisions. It is therefore important that the Data User enter into written agreements with appropriate representations and covenants concerning compliance by such third parties, with commensurate indemnifications for breach. Data Users should also verify that the intended use of the personal data is consistent with the consent obtained by the third party.
How to Inform and Obtain Consent?
Regardless whether the Data User is the actual user or provider
of personal data, the overarching theme under the Amendments is
that the Data Subjects must be adequately informed and have
provided their express consent to direct marketing. Under the
Amendments, Data Subjects must be informed (a) of the intended use
of personal data and (b) that the Data User cannot use the personal
data without the Data Subject's consent. Data Subjects should
be furnished with information concerning the kinds of personal data
to be used, the types of direct marketing and marketing subjects
employed, and how to indicate consent. In cases where the Data User
is a provider of personal data, it must also notify whether the
transfer of personal data to a third party is for gain (money or
other property10), and the classes of persons to which
the personal data is to be provided.
With regard to the grandfathering provision referred to above, the
information provided to Data Subjects should be easily
understandable and easily readable (if written). If the Data User
is a provider of personal data, then all information provided and
consents obtained must be in writing.
"Consent" in this context means express consent, and
includes "an indication of no objection to the use or
provision" of personal data. Silence is insufficient for this
purpose. Specifically, an option to opt-out of direct marketing
activities will not be sufficient. Thus, the Data User must require
the Data Subject to perform an action to indicate express consent,
whether it be signing a form without indicating objection, or
ticking a box to indicate consent or no objection. Data Users
should also give Data Subjects the opportunity to indicate their
consent selectively in relation to separate items of personal data.
This is particularly important where certain personal data is not
collected for the principal purpose of direct marketing. For
instance, where personal data is collected for the purpose of
opening a bank account (primary purpose) and additional personal
data is collected for the purpose of marketing insurance products
(secondary purpose), the Data Subject should be allowed to choose
whether to consent to the secondary purpose without jeopardizing
his or her eligibility for the primary purpose.11
How to Deal With A Request to Cease Use of Personal Data?
When using a Data Subject's personal data for direct marketing for the first time, Data Users are required to notify the Data Subject of such use and expressly inform the Data Subject that he or she may at any time require the Data User to cease such use. This provision operates in conjunction with Section 26 of the PDPO, which requires Data Users to erase personal data no longer required for the purpose for which it was used. Companies should put in place processes and procedures to periodically assess whether personal data which is not to be used for direct marketing should be erased.
Conclusion
Given the increased penalty for contravention of these
requirements, businesses should conduct a compliance assessment of
their direct marketing programs. Businesses should determine
whether any exceptions apply, or whether the grandfathering
provisions can be relied upon. Those that are engaged in direct
marketing activities should by now have completed, or at least have
begun, reviewing and overhauling their existing data privacy
compliance policies. Forms and notices given to Data Subjects
should be updated to include the prescribed information in
sufficient detail, and for information imparted orally, staff
should receive training so they are aware of the new
requirements.
Data Users should adopt processes to keep track of the source of
personal data being used, consents received, and any requests to
cease use of personal data. Although there is as yet no legal
obligation on Data Users to reveal the source of their personal
data, keeping good records will assist in establishing the defence
that all reasonable precautions have been taken and all due
diligence was exercised should a complaint be lodged or proceedings
be initiated against the Data User.
Footnotes
1.www.gld.gov.hk/egazette/pdf/20121627/es12012162718.pdf .
2.The higher penalty also applies when personal data is disclosed without consent with the intention to obtain gain or cause loss to the Data Subject.
3.Part VIII of PDPO.
4.Section 63B of PDPO.
5.Office of the Privacy Commissioner for Personal Data, New Guidance on Direct Marketing (January 2013) ("Guidance Notes").
6.Section 35I of the PDPO.
7.Guidance Notes.
8.Section 35E and 35K of PDPO.
9.Section 35D of the PDPO.
10.This includes present or future interests vested or contingent, arising out of money, goods, choses in action and land (section 3, Interpretation and General Clauses Ordinance).
11.Guidance Notes.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.