Personal Information Collection Statement

Examples of personal data used in everyday life include a person's name, telephone number, fax number, address, sex, age, occupation, marital status, salary and financial status, religious belief, nationality, photo, identity card number, medical records and employment records, including assessments of employment performance.

The major amendment under the revised Ordinance focuses mainly on the use of personal data in direct marketing. There are two sets of new rules under the Ordinance:
a. Use of personal data for direct marketing; and
b. Provision of personal data to a third party for the purposes of direct marketing

When using personal data for direct marketing purposes for the first time, you must get the consent of the customer and inform them that they may access and correct their personal data or request you to stop using their personal data for this purpose at no cost. Then you must stop using their personal data once requested to do so by the customer.

a. For the “Use of personal data for direct marketing”: 
Before using personal data for direct marketing purposes, you must inform customers that you intend to use their personal data, and provide them with details of (i) the type of data being collected and (ii) the classes of marketing subjects. The details should be easily readable and understandable. Customers may express their consent through the channel provided by you in which the consent can be an “indication of no objection” to use their personal data, therefore an “opt out” is acceptable.
b. For “Provision of personal data to a third party for the purposes of direct marketing”: 

Before transferring personal data to a third party, you must inform customers that their personal data will be transferred to a third party for direct marketing purposes (for gain, if applicable) by written notice including type of data being transferred, classes of persons to which data will be provided and classes of marketing subjects. 

You must provide a channel for customers to express their consent for transferring their personal data by allowing them to show “indication of no objection”.

The notification must be presented in a manner that is easily understandable and in written form, which is easily readable. 
Therefore, it is recommended to provide a tick box for customers to indicate their objection.

Yes, as long as the PICS statement is presented to customers in an easily understandable and readable format.

A data processor is a person who processes personal data not for his own purposes but on behalf of another person. For example, an SMS service provider who sends an SMS containing travel policy details to a policyholder on behalf of MSIG.

No, he does not.

If the agent intends to use the personal data of the customer for direct marketing purposes, he needs to present the PICS to the customer before/at the time of collecting of his/her personal data.

No. As the eDM did not reach the customer successfully before 1 April 2013, the grandfather exception does not apply to this personal data. You must get his consent before using direct marketing to contact him under the new rule.

Yes, you may use direct marketing to contact this customer as long as you have got his consent before the effective date of the new rule and he has not withdrawn his consent for direct marketing.

No, you can only do so when you have received their explicit consent for direct marketing.

Yes, new consent has to be obtained if the bank later intends to transfer the customer’s personal data to the bank’s associate company (insurance company) for the latter’s direct marketing of its products.

Yes, customers may request to opt out of your use of their personal data at any time. You must stop using the data for direct marketing purposes and notify any person to whom data has been provided to stop using the data for direct marketing purposes once you receive the customer’s request.

For breaching the Ordinance with regard to using personal data for direct marketing purposes, the maximum penalty is HK$500,000 and 3 years imprisonment. 
For breaching the Ordinance with regard to providing personal data to a third party for the purposes of direct marketing for gain, the maximum penalty is HK$1,000,000 and 5 years imprisonment. If not for gain, the maximum penalty is HK$500,000 and 3 years imprisonment.

The Ordinance is effective starting from 1 April 2013. Starting from 1 April 2013, all policy transactions will be bound by the Ordinance.

Yes. Following the guidance recently released by the HKFI, we have prepared an interim version of the PICS in loose sheets to supersede the PICS originally printed on the application/proposal forms. 

For more detailed information, please refer to the relevant guidelines by visiting the website of the Office of the Privacy Commission for Personal Data, Hong Kong (http://www.pcpd.org.hk).