First published: 18th May 2016
Marketing company, GMS (Asia Pacific) Limited ("GMS"), was fined HK$16,000 at the Kwun Tong Magistrates' Court on 16th May 2016 after pleading guilty to two offences under the Personal Data (Privacy) Ordinance (PDPO). The charges were using personal data without consent, contrary to section 35C of the PDPO and not complying with an opt-out request, contrary to section 35G of the PDPO.
In ay 2014, a complaint was made to the Privacy Commissioner from a person who had once made a hotel restaurant reservation, providing their surname and phone number. They stated that they had never given written or verbal consent for use of their personal data for direct marketing. Since then, they had received calls promoting the membership and services of the hotel. In April 2014, they received a call from GMS promoting the hotel and they requested opt-out. GMS agreed, but called again in May 2014.
GMS admitted receiving the opt-out request and claimed to have notified its IT department to place the number on their opt-out list, but suggested blame lay with part-time promoters who had not received or had overlooked the updated opt-out list.
The Privacy Commissioner for Personal Data Mr Stephen Kai-yi WONG said, "In order to comply with the marketing target's (data subject's) opt-out request effectively, marketing companies (data users) have to maintain a list of all customers who have indicated that they do not wish to receive further marketing approaches (i.e., the "Opt-Out List") and distribute the Opt-Out List to the staff members of the relevant department in a timely manner and thereafter communicate with the department from time to time. If the list is distributed other than by a computer network, it is recommended that marketing staff members are notified of the updates at a frequency of no less than once per week. A marketing company should have standing procedures for its staff members to follow and provide appropriate training with regard to accessing and updating the Opt-Out List for compliance with opt-out requests by marketing targets."
Yui Kee's Chief Consultant, Allan Dyer, commented, "Marketing companies are stupid and irresponsible if they rely on call centre staff to manually check their opt-out list. They provide the list of numbers to call to the staff, so they should automatically filter that list, removing matches with the opt-out list before they are provided to the staff."
