ParknShop supermarket has been fined HK$3,000 for using the personal data of a customer for direct email marketing without obtaining the their consent.
The conviction for violating section 35E(1) of the Personal Data (Privacy) Ordinance was handed down on Tuesday at the Tuen Mun Magistrates’ Court. The company pleaded guilty.
The case stemmed from a complaint received by the Office of the Privacy Commissioner for Personal Data in January 2016, when a customer used his personal data to register for the firm’s online supermarket. The complainant never indicated that he wished to receive any promotional materials, yet received a direct marketing email that month.
As the complaint was processed by the Office, the company admitted that the complainant had not given consent, yet it accidentally sent a marketing email owing to an isolated incident of human error while a system update was underway.
The Office said it was the first conviction for the offence since the amendment of the section relating to direct marketing came into effect on 1 April 2013.
Privacy Commissioner Stephen Wong said the ordinance does not prohibit direct marketing activities but organisations must comply with the requirements of obtaining consent.
“Appropriate training must be provided to its staff members to ensure their awareness of and compliance with the direct marketing provisions under the Ordinance,” Wong said. “The conviction once again reminds organisations of such requirements, and at the same time strengthens the culture of respecting personal data privacy within organisations.”
The Privacy Commissioner also reminded consumers that they should make a record and gather as many details as possible in order to lodge a complaint when they received direct marketing materials without consent.
Under the section 35E(1) of the ordinance, failure to comply with the requirement is a criminal offence which is punishable by a fine of up to HK$500,000 and imprisonment of up to 3 years.
