The provisions in Hong Kong’s Personal Data (Privacy) (Amendment) Ordinance 2012 (“Amendment Ordinance”) relating to direct marketing came into effect on 1 April 2013. The Amendment Ordinance prescribes heightened requirements for use of personal data in direct marketing.
Under the Amendment Ordinance, any data user (including insurance institutions and insurance practitioners) must, before carrying out direct marketing, inform a customer or potential customer, that their personal data will be used for direct marketing and the kind of products that they are going to market. As such, insurance institutions and insurance practitioners must not use the personal data of customers or potential customers to make a direct marketing approach, or provide such personal data to their agents for use in direct marketing, without customer consent. Guidance issued in January 2013 by the Office of the Privacy Commissioner for Personal Data makes it clear that silence is not valid consent (but that not checking a box indicating an objection, coupled with returning the form, can be valid consent).
Insurance institutions will also no longer be able to say that they intend to use all of a customer’s or potential customer’s personal data or that they will use personal data for general marketing purposes. Insurance institutions need to specify what personal data they want to use such as name, address, phone number, email address, marital status, employment status and / or earnings, and so on. They will also need to specify the different types of products they want to market. It follows that customers must be given a choice as to the kinds of personal data they will permit to be used for direct marketing and the specific products they will permit to be marketed to them. Thus, a customer may agree to the use of their email address but no other data, and may agree to receive marketing materials in relation to certain types of insurance products but not others.
In addition to the new requirements, insurance institutions must continue to inform a customer of his opt-out right when using his data for direct marketing for the first time, and to stop using his data for direct marketing if he opts out. The Amendment Ordinance makes it clear that a customer has the right to opt-out from direct marketing at any time, irrespective of whether he has previously consented to the use of his data for direct marketing.
Contravention of the new requirements by a data user constitutes an offence punishable by a fine of up to HK$500,000 (US$65,000) and imprisonment for up to three years.
As a result of the Amendment Ordinance, insurance institutions will have to exercise great care when drafting direct marketing notices and in setting up systems to administer their direct marketing programmes. It is also likely that insurance companies will cut back on direct marketing. This view has been echoed by the CEO of MassMutual Asia, Mr Tay Keng Puang, who has indicated in the media that insurance companies will go back to use of traditional insurance agents to sell their policies.