Consumers combat cold-callers as law strengthens privacy protection
By Viola Yeh & Yannie Mak
There can be few adults in Hong Kong who have not received unwanted direct marketing ads in their letter boxes and email inboxes, or received cold calls from companies they have never heard of, selling services they are not interested in. Often, we wonder how they got our addresses and phone numbers.
Concern over personal data reached new heights in 2010 when, after months of denial, Octopus Cards Limited finally admitted it had sold the personal data of two million Octopus Card holders to third parties, for a total of more than HK$44 million. This information included their names, telephone numbers, gender, identity card numbers and even Octopus Card purchase histories.
In the wake of the fiasco, the Privacy Commissioner on Personal Data (PCPD) issued a set of guidelines on direct marketing practices. But they were just that, guidelines lacking teeth. Those teeth have now finally arrived after the Legislative Council passed a set of amendments in July that will tighten restrictions on the use and transfer of personal data, impose strict regulations on direct marketing, introduce heftier fines for violations and make it easier for consumers to take legal action against those who misuse their personal information.
The amended ordinance creates a new offence of disclosure of personal data obtained without consent. Data users – organisations that collect data from customers and other individuals – are required to notify consumers about what their information will be used for and get their written consent before it can be used for direct marketing. Likewise, if the user wishes to transfer that data to any third party for other marketing uses.
If the data user discloses any personal data obtained without a person’s consent in order to gain benefit, they face a maximum fine of HK$1 million and a five-year jail term.
The changes also mean the PCPD will have greater powers to enforce the provisions and provide legal assistance to people whose data has been misused. This means people can pursue compensation claims without being deterred by enormous legal costs or necessarily going to court. The first phase of the ordinance came into effect in October, and the other provisions that include those related to direct marketing are expected to be implemented early next year.
A spokesman for the PCPD said the amendments were necessary because, “the collection and use of personal data in this era of ‘big data’ can create great economic and societal value. But they also pose immense risks to privacy and raise serious concerns about the protection of personal data.”
