In January 2013, the Privacy Commissioner for Personal Data (“Commissioner”) issued a guidance note “New Guidance on Direct Marketing” and a leaflet “Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance” to provide practical guidance to deal with the new provisions on direct marketing in the Personal Data (Privacy) Ordinance which will come into effect on 1 April 2013. Below are some of the items that have been discussed in the guidance note and the leaflet.
First of all, one should pay attention to what activities constitute direct marketing. The Commissioner has provided some examples on direct marketing activities e.g. calling existing customers to offer services, sending marketing SMS to a mobile number of a named individual. On the other hand, introducing services to a customer face-to-face or calling a phone number randomly generated to market services do not constitute direct marketing.
Where consent is required for the use of personal data or provision of personal data to another person for direct marketing purposes, it should be noted that the consent should be an explicit consent (including an indication of no objection) and non-response or mere silence would not constitute consent. The data user has to make sure that it has received the valid consent before using the personal data for direct marketing purposes.
The data subject when giving his/her consent should pay special attention to the kind of consent that he/she is giving, i.e. whether it is a selective consent or a general consent. A selective consent means that the consent is only in relation to certain kinds of personal data, and/or certain classes of marketing subjects and/or certain classes of transferees to whom the data user provides personal data for use in direct marketing. On the other hand, a general consent means a blanket approval to use or provision of use of personal data for direct marketing purposes.
If the consent is to be obtained on an application form for the data user’s services, it is advisable that the data user provides a separate checkbox or signature space to the data subject so that he/she can give separate consent in relation to the use or provision of use of personal data. The consent should not be bundled together with the agreement to the provision of services by the data user.
When informing the data subjects about the marketing subjects, the data user needs to bear in mind that the description of the classes of marketing subjects should be specific enough for the data subject to ascertain the goods or services with a reasonable degree of certainty. A description which is too broad or too vague would not be acceptable. For example, by saying “all good and services offered by a XYZ company” would not be acceptable.
Response channel is a channel provided by a data user to a data subject for giving his/her consent to the use or provision for use of personal data. The guidance note and the leaflet have set out the means of communication which can include telephone hotline, fax number, a designated email account, online facility, correspondence address or a designated person to handle the request. All channels have to be free of charge.