Hong KongPersonal Data (Privacy) Ordinance, use and provision of personal data in direct marketing
Personal Data (Privacy) Ordinance (Cap. 486), Part 6A, ss. 35C-35L
In force since .
A data subject rights rule binding public and private bodies.
- Enforcement body
- Privacy Commissioner for Personal Data
- Obligation class
- Consent, Data subject rights, Disclosure
As of .
What it requires
- Before using a person's personal data in direct marketing, tell them you intend to, that you may not unless they consent, the kinds of personal data and classes of marketing subjects, and give them a free channel to consent (section 35C).
- Do not use personal data in direct marketing without the data subject's consent, and confirm an oral consent in writing within 14 days (section 35E).
- Tell a data subject, when first using their personal data in direct marketing, that you must stop free of charge if they ask, and stop when they require it (sections 35F and 35G).
- Do not provide personal data to another person for use in direct marketing without the data subject's written consent, after giving the written information section 35J requires (sections 35J and 35K).
- Stop providing a data subject's personal data to others for direct marketing, and notify recipients in writing to stop using it, when the data subject requires it (section 35L).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Providing personal data to another person for use in direct marketing without giving the information section 35J requires (section 35J(5)), without the data subject's written consent (section 35K(4)), or after the data subject has required the data user to stop (section 35L(6)) carries a fine of $1,000,000 and imprisonment for 5 years where the data is provided for gain, and a fine of $500,000 and imprisonment for 3 years otherwise; the offences in sections 35C, 35E, 35F, 35G and 35L(7) carry a fine of $500,000 and imprisonment for 3 years.
Penalty structure
Highest fine in Part 6A, for providing personal data for gain; imprisonment of up to 5 years may be imposed with it.
- Rule
- Fixed only
- As of
- Currency
- HKD
- Fixed cap
- 1,000,000
What this law does
Section 35C requires a data user that intends to use personal data in direct marketing to tell the data subject so, to say that it may not do so without the data subject's consent, and to give the kinds of data and classes of marketing subjects and a free channel for consent. Section 35E bars the use without that consent, and section 35G lets a data subject require the data user at any time to stop, free of charge.
Sections 35J and 35K bar providing personal data to another person for use in direct marketing without the data subject's written consent, and section 35L lets a data subject require the data user to stop providing it.
A data user that provides personal data for gain without giving the information section 35J requires, without the data subject's written consent, or after being required to stop, faces a fine of $1,000,000 and imprisonment for 5 years (sections 35J(5), 35K(4) and 35L(6)), and the other offences in Part 6A carry a fine of $500,000 and imprisonment for 3 years. Each offence has a defence that the data user took all reasonable precautions and exercised all due diligence.
Section 35D disapplies section 35C for a use the data subject had been explicitly told of, and had not objected to, before Part 6A commenced, and for data received from a person who has confirmed in writing that sections 35J and 35K were complied with.
When LexLint raises it
When your app profile says your app processes personal data or sends automated outreach.