The Hong Kong Privacy Commissioner for Personal Data recently announced the first two convictions under the new direct marketing provisions of the Personal Data (Privacy) Ordinance that came into force on April 1, 2013. 

The Hong Kong Privacy Commissioner for Personal Data recently announced the first two convictions under the new direct marketing provisions of the Personal Data (Privacy) Ordinance (the “PDPO”) that came into force on April 1, 2013. The first conviction was against Hong Kong’s largest broadband company, which was held to have sent out direct marketing promotions to a customer who had made an opt-out request already acknowledged by the company. The company was fined HK$30,000 (approx. US$3,900). The company had contacted the customer by telephone after the opt-out request. The Hong Kong court dismissed the company’s argument that the message was simply to remind the customer that his contract would soon expire and found the reminder to be “an opener to direct marketing”.

In the same week, a storage service provider was convicted of sending a direct marketing email to a consumer without the individual’s consent. The court held that individual was not a customer of the company and had not given consent to the use of personal data for direct marketing purposes despite the fact that the company had taken over another company with which the individual had a past relationship. The company was fined HK$10,000 (approx. US$1,300).

Under the new direct marketing provisions of the PDPO, it is an offense to use a customer’s personal data for direct marketing purposes either without the customer’s consent or where the customer has sent an opt-out request to the company. The maximum penalty is a fine up to HK$500,000 (approx. US$64,500) and imprisonment for three years. While the fines imposed to date are relatively low in value, the indication is that the violations of direct marketing restrictions will be more stringently enforced going forward. Commentators also suggest that even if fines are low, there may be significant reputational damage for companies.

While the new direct marketing regulatory regime has been in force for more than two years, there were no public prosecutions during Allan Chiang’s tenure as privacy commissioner. The recent convictions were made shortly after Stephen Wong took over the position on August 4, 2015. Mr. Wong was a public prosecutor prior to becoming the new privacy commissioner with the stated aim of strengthening the “culture of respecting personal data privacy”.

Tip: The recent convictions in Hong Kong send a strong message to companies that they should have adequate procedures in place to ensure compliance with the PDPO when engaging in direct marketing activities and ensure that the procedures are strictly followed by their staff. In particular, companies are reminded to update their opt-out list regularly as part of their privacy procedures to avoid inadvertent violations.