Introduction

On 9 September 2015, Hong Kong Broadband Network Limited (“HKBN”) was fined HK$30,000 for failing to comply with the request of a data subject (a customer of HKBN) to cease to use his personal data in direct marketing (“HKBN Case”).

This was the first conviction under section 35G of the Personal Data (Privacy) Ordinance (Cap 486) (the “Ordinance”) in relation to direct marketing which came into effect on 1 April 2013.

Brief facts of the HKBN Case

1.       In April 2013, Mr. Chan (“Mr. Chan”), a customer of HKBN notified HKBN by email and by mail that he did not wish his personal data be used in direct marketing (“Opt-Out Request”).

2.       HKBN acknowledged Mr. Chan’s Opt-Out Request in writing.

3.       In May 2013, notwithstanding Mr. Chan’s Opt-Out Request, HKBN’s staff left a voice message through Mr. Chan’s mobile phone, reminding him that his service contract with HKBN was about to expire and at the same time promoting HKBN’s services to him.

4.       Mr. Chan complained to the Office of the Privacy Commissioner for Personal Data (“Privacy Commissioner”).

5.       Investigation was conducted and the case was eventually determined by the Magistrates’ Court.

6.       HKBN argued that its employee was simply reminding Mr. Chan that his contract would soon expire and that would result in him being asked to pay more after the expiry of his discounted deal.   

7.       The Court took the view that “the ‘reminder’ was merely used to start the conversation and the true purpose of the phone call was to ask Mr. Chan to renew his contract.  The ‘reminder’ was an ‘opener’ to direct marketing”.

8.       The Court also commented that if the phone call was truly an effort to remind Mr. Chan that his contract will expire soon, HKBN would not have to call Mr. Chan more than 6 months in advance before the expiry date of the contract.

9.       HKBN was convicted under Section 35G of the Ordinance and fined HK$30,000.

Relevant law

Section 35G of the Ordinance stipulates that:

(1)    “A data subject (e.g. Mr. Chan in the HKBN Case) may, at any time, require a data user (e.g. HKBN in the HKBN Case) to cease to use the data subject’s personal data in direct marketing.

(2)    ......

(3)    A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data subject, comply with the requirement.

(4)    A data user who contravenes subsection (3) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years.

(5)    In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence…….”

Comments from the Privacy Commissioner

The Privacy Commissioner made the following comments in relation to the HKBN Case:

1.       Opt-Out Requests from consumers must be complied with and the use of consumers’ personal data must be respected.

2.       The Commissioner hoped that the conviction in the HKBN Case and the penalty imposed will serve as a deterrent and strengthen the culture of respecting personal data privacy. 

3.       Organizations/companies should update the Opt-Out Request/List regularly and ensure that they have the relevant procedures for their staff to follow to comply with such requests.

4.       On the other hand, if data subjects (individuals) no longer wish to receive direct marketing messages, they should file an Opt-Out Request preferably in writing and keep a copy of it. If they still receive direct marketing messages after making the Opt-Out Request, they should make a record and gather as many details of the direct marketing messages as possible in order to lodge a successful complaint.

Conclusion

As HKBN said that it would lodge an appeal against the conviction, we have to wait and see if the higher Court will take a different view concerning the application of Section 35G of the Ordinance. Nevertheless, the HKBN Case serves as a reminder for organisations and companies engaged in direct marketing to formulate the relevant policies and procedures so that their staff would know what they should do in order to comply with the Opt-Out Request of the data subject (e.g. their customers). More importantly, the company has to establish a good system to check and ensure that in practice, their staff actually respects personal data privacy and act according to the Opt-Out Request.