What is sensitive personal data? However, the Privacy Commissioner has issued Codes of Practice setting out specific requirements in respect of certain types of personal data such as identity card numbers, personal identifiers and consumer credit data. The Privacy Commissioner has also indicated that biometric data should only be collected where it is necessary and with the consent of the data subject. Are there additional rules for processing sensitive personal data?
Since its implementation, no individual or organisation has been convicted for acting in breach of the provisions on direct marketing in the PDPO, until now. Failure to comply with opt-out request PDPO Section 35G 3 On 9 SeptemberHong Kong Broadband Network Limited "HK Broadband" was convicted of acting in breach of section 35G 3 of the PDPO, which provides that a data user who receives a request for cessation of using the data subject's personal data in direct marketing must, without charge to the data subject, comply with the request.
It has also been recommended that companies should maintain an "opt-out" list for keeping a record of any requests. HK Broadband's conviction relates to an incident which occurred during Aprilwhen a customer of HK Broadband sent an opt-out request to HK Broadband by email and by post.
HK Broadband subsequently acknowledged receipt of the request in writing. Despite this however, the customer received a voice message on his mobile telephone from an employee of HK Broadband in Mayto inform him of the expiration of his service contract, and also to promote other services of HK Broadband.
At the hearing, the presiding Magistrate rejected HK Broadband's defence that the telephone call was simply a reminder to the customer that his contract would soon expire.
The Magistrate found that the true purpose of the telephone call was to promote HK Broadband's services, and that the 'reminder' to the customer about the end of his contract was an opener to direct marketing.
Additionally, the Magistrate found that the call was made more than half a year before the customer's contract was due to expire, and that if HK Broadband's real intent was to remind its customer of the end of his service contract, a written reminder notice or text message sent to the complainant would have been sufficient.
It has been reported that HK Broadband intends to appeal the conviction. Failure to take specified steps and obtaining consent before using personal data PDPO - Section 35C The second conviction under the direct marketing provisions of the PDPO concerned Links International Relocation Limited "Links"which was charged with the offence of using personal data of a customer in direct marketing without taking specified action, contrary to section 35C of the PDPO.
In the Links case, an individual provided his personal data which included his mobile telephone number, company email address and residential address to a company which provided storage services.
This company subsequently ceased business in Hong Kong and was taken over by Links, which also provided similar storage services. During AugustLinks sent a direct marketing email to the same individual, identifying him, and providing storage service quotations and terms and conditions.
Seeing as the individual never had any prior dealings with Links, nor had he ever been informed or given his consent to Links in relation to the use of his personal data for direct marketing, it was unclear to him why his personal information was accessible by Links.
He therefore made a complaint to the PDPC, and the case was referred to the Police for criminal investigation.The PDPO applies where the data user in question controls the processing of data in or from Hong Kong even if the data processing cycle occurs outside Hong Kong.
The PDPO does not contain any express provisions conferring extra-territorial application. persons (whether within or outside of Hong Kong) for the purposes set out in sub-paragraph (4) of this Statement: (i) any nominees in whose name securities or other assets may be registered; Any such request must be made in accordance with the PDPO and shall be addressed to the /.
We anticipate that the Hong Kong courts will start to take a more hard-line approach to offenders under the PDPO, not only in respect of Section 50B(1)(b)(i), but also other provisions, for example Section 35E (which makes it an offence to use an individual’s personal data for direct marketing without their consent), Section 50A (which makes.
Office of the Privacy Commissioner for Personal Data, Hong Kong. Speaker(s) Albert So University Lecturer, Executive Committee Member of International Chamber of Commerce (Hong Kong), Accredited Mediator, Accredited Family Mediator, Arbitrator, Certified Anti-Money Laundering Specialist, Certified Financial Crimes Specialist, Member of Association of Certified Fraud Examiners, and Honorary Legal Advisor of Tung Wah Group of Hospitals (Long Love .
Drafting and Making Legislation in Hong Kong Drafting Legislation in Hong Kong— A Guide to Styles and Practices How Legislation is Made in Hong Kong.