Data Protection: Lessons in Direct Marketing

On 26 January 2017, the Court of First Instance handed down a judgment on s.35G of Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) in HKSAR v Hong Kong Broadband Network Limited, HCMA 624/2015. The case involves a telecommunications service provider (the data user) (“A”) approaching its then customer (the data subject) by telephone to offer an extended service at a discounted price.

The data subject was a customer of A since December 2011 for two years, with a contract expiring in December 2013. Despite an earlier request given by the data subject to A, demanding that A cease using his personal data in direct marketing, an employee of A left a voice message to the data subject informing him that his contract would expire soon and that A could provide a renewal offer at a discounted price.

The voice message reads, inter alia, “Hello Mr. Chan … your contract is about to expire … there will be an increase in price in June and we do not wish you to pay a higher price … therefore I would like to let you know that if you are happy with our 1000M services, we can give you a promotional offer this month so that you will not be affected by the increase in price. Please return a call to me when you receive this voice message … .”

A was convicted of having contravened s. 35G of the PDPO which provides that a data user who receives a request from a data subject to cease using his or her personal data in direct marketing must comply with such request.

It was argued by A in the appeal that the purpose of the voice message was a reminder to the customer of his expiring contract and that the Prosecution must prove that A had the mens rea to conduct direct marketing beyond reasonable doubt. It was further argued that the voice message was only a demonstration of good after-sales customer service which does not constitute a “new purpose” as stipulated in Principle 3 of the Data Protection Principles.

The Court of First Instance had a different view.

It was held that on the true construction of the legislative intent of the PDPO and having regard to the regulatory nature of s. 35G, it is not necessary for the Prosecution to prove mens rea in respect of s. 35G, particularly in view of the wording used and the statutory defence provided in the same section.

So far as this case is concerned, direct marketing refers to the offering or advertising of the availability of goods, facilities or services. It was held that the first part of the voice message which reminded the data subject of his expiring contract was merely an opening remark for A to offer other services. The voice message went beyond a simple reminder, and since “offering” and “advertising” must not be narrowly interpreted, the voice message constituted a “new purpose” and direct marketing.

The precautions in place were insufficient to prevent direct marketing. It was argued by the Defence that the employee departed from the standard script of A; however, the Court found that the standard script itself included words that introduce the renewal of service plans and therefore constituted direct marketing. Audio recordings of telephone calls were also held to be insufficient measures to prevent employees from violating the laws.

As a result, A was unable to rely on the statutory defence as it had not taken all reasonable precautions or exercised all due diligence to avoid commission of the offence.

Take-Away Points

This is one of the earliest prosecutions under s. 35G of the revised PDPO, which came into effect on 1 April 2013. The Defendant was fined HK$30,000. Following conviction in the Magistracy, the then Privacy Commissioner issued a statement indicating that he hoped the verdict would enhance respect for the privacy of personal data. Solicitors whose clients engage in direct marketing should advise them of this recent case and work with them to ensure their activities are compliant with the law as interpreted.

Jurisdictions: