Five things fund promoters should know about "direct marketing" in Hong Kong

The provisions of the Personal Data (Privacy) (Amendment) Ordinance (PDPAO) relating to direct marketing are expected to come into effect in April 2013. Here we answer five key questions for fund promoters.

1. I regularly contact my Hong Kong clients about fund products which may interest them. Is this direct marketing?

   Yes, the law defines "direct marketing" very broadly.

2. How can I comply with the new requirements when direct marketing to Hong Kong clients for the first time?

   Before using personal data for direct marketing purposes, you (the data user) must inform the client (the data subject) that the personal data may be used for direct marketing and obtain the client's prior informed consent or indication of no objection. You must provide the client with information about the personal data to be used (e.g. name, telephone); the class of products, facilities or services to be marketed; and a response channel whereby the client can provide consent. For existing clients, there are "grandfathering" provisions: see question 4.

3. Do I need to get the client's consent every time I wish to market a new product or service?

   Client consent can be obtained generally or selectively with regard to the intended use of the personal data, and one-off consent will be acceptable provided the consent is not withdrawn.

4. What about existing clients?

   Are there any transitional measures? The PDPAO has "grandfathering" provisions: the direct marketing provisions will not apply if, before commencement of the PDPAO's direct marketing regime, (i) you explicitly and clearly informed the client of the intended use of the personal data for direct marketing of a class of products, facilities or services; (ii) you have used the data for this purpose; (iii) the client has not required you to stop doing so; and (iv) you otherwise comply with the PDPAO.

5. Our Hong Kong office is a subsidiary of an international organisation. What steps should we be taking to ensure good data protection practices?

   Any transfer of personal data for direct marketing (whether intra group or not) must comply with the new PDPAO requirements. You will need to provide the information noted at 2 above in writing, state if such transfer is for gain, and obtain the prior specific informed consent of the client for such transfer. Companies transferring clients' personal data to group companies for use in direct marketing should review how such data is transferred, how such transfers are tracked and who is responsible for managing and monitoring personal data requests. Non-compliance with the provisions where personal data are provided for gain will constitute a criminal offence with fines of up to HK$1,000,000 and imprisonment for up to five years; where the breaches are not in respect of provision of personal data for gain, the sanctions are fines of up to HK$500,000 and imprisonment for up to three years. A defence is available if the data user can prove that it took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.

In order to benefit from the defence, companies are advised to review current practices regarding the collection and use of personal data in direct marketing in order to promote compliance with the PDPAO and to demonstrate adequate measures are in place.