Nov 042015
 November 4, 2015  Posted by  Breaches, Business, Non-U.S.

Hong Kong Professional Health Group Limited (the “Company”) was convicted today at the Tuen Mun Magistrates’ Court of the offence under section 35G(3) of the Personal Data (Privacy) Ordinance (the “Ordinance”) for failure to comply with the requirement from its client to cease to use his personal data in direct marketing. The Company was fined HK$10,000. This is the third conviction of the provisions under the new direct marketing regime since it came into force on 1 April 2013.

The Office of the Privacy Commissioner for Personal Data (“PCPD”) has received 1,005 complaints from 1 April 2013 to 31 Oct 2015. Of these 1,005 complaints, 538 (54%) concerned the failure to comply with customers’ opt-out requests by organisations or companies.

Under section 35G(3) of the Ordinance, a company which receives a request for cessation of using personal data in direct marketing must comply with the request without charge. Failure to comply with the requirements is a criminal offence punishable by a fine of up to HK$500,000 and imprisonment for up to 3 years.

The Privacy Commissioner for Personal Data Mr Stephen Wong stressed, “Companies should conduct direct marketing activities in a more customer-focused manner. To ensure compliance and avoid to be prosecuted, companies have to maintain an updated “Opt-Out List” of all customers and communicate with the marketers with a view to ceasing the use of customers’ personal data in direct marketing. Upon receipt of an opt-out request, the company should adopt a systematic approach to comply with the request effectively. This is conducive to building customer trust, and enhancing the professionalism of the industry as well as the effectiveness of direct marketing. If companies need assistance and wish to better understand the requirements of the Ordinance and relevant management system, they are more than welcome to join our workshops or visit our website at”

Meanwhile, Mr Wong reminded, “Consumers may at any time make an opt-out request to a commercial enterprise. If consumers no longer wish to receive direct marketing messages, they should make a clear opt-out request, preferably in writing, and keep a copy of it. If they still receive direct marketing messages after making an opt-out request, they should record the details of the direct marketing messages and file a complaint with the PCPD.”

Case Background

The complainant was an ex-customer of the Company. Since mid-2013, the Company had repeatedly made direct marketing calls to the complainant promoting body check up services. Despite the complainant’s earlier verbal and written opt-out requests, the Company still made a direct marketing call to him on 28 July 2014. The complainant hence lodged a complaint with the PCPD.

PCPD’s Publications about Direct Marketing

Consumers and organisations engaging in direct marketing may visit PCPD’s website at for more information about regulation of direct marketing.

For guidance on legal compliance, organisations should refer to PCPD’s “Guidance on Direct Marketing” available at

An easy-to-understand infographic “It is Your Choice to Accept or Refuse Direct Marketing” for member of the public is also available at 

PCPD has also issued an updated Information Leaflet entitled “Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance”. This information leaflet can be downloaded from PCPD’s website at

SOURCE: Hong Kong Office of the Privacy Commissioner for Personal Data

Sorry, the comment form is closed at this time.