First published: 04th January 2018
Hong Kong supermarket PARKnSHOP was convicted of using personal data in direct marketing without consent and fined HK$3000 at Tuen Mun Magistrates’ Court on 2nd January. The offence was under section 35E(1) of the Personal Data (Privacy) Ordinance which was an amendment that came into effect on 1st April 2013 and this was the first conviction for the offence.
Stephen Wong, the privacy commissioner for personal data, explained that the Ordinance does not prohibit direct marketing but, “Organizations must obtain a data subject’s consent before using his personal data in direct marketing.”
In this case, the complainant was a registered customer of PARKnSHOP's online store, but had not consented to receiving direct marketing materials. The complainant received a direct marketing email in January 2016. PARKnSHOP pleaded guilty, and clarified that the email was accidentally sent due to an isolated incident of human error during a system update.
Failure to comply with section 35E(1) is a criminal offence with a maximum penalty of a fine of up to HK$500,000 and imprisonment of up to 3 years. The Privacy Commissioner has published guidance: New Guidance on Direct Marketing to assist data users.