Investigation Report : Collection of Personal Data for Promotional Purpose


1. The Privacy Commissioner for Personal Data ("the Commissioner") Mr. Roderick B. Woo published today (21 September) a report (“the Report”) on a self-initiated investigation in which a credit company (“the Company”) was found collecting excessive personal data from the public in a promotional activity.

2. "Although commercial companies have a legitimate purpose to collect personal data of prospective customers for marketing purpose, they should not collect sensitive personal data such as ID card number in a non-discriminatory manner.  In compliance with the Personal Data (Privacy) Ordinance, data users should seriously consider whether there are genuine needs for collecting the personal data for the related purposes, or whether there are other alternatives that could avoid the collection of such data." Mr. Woo said.

3. "I would also like to remind the public to be alert when being asked by commercial concerns to give their personal information.  Before disclosing their personal information, they should ascertain whether the data are collected for a lawful purpose directly related to a function or activity of the collecting party, and whether the data to be collected are necessary and not excessive.  In case of doubt, clarify with the collecting party and ask for more details." Mr. Woo added.

4. The Report sets out the background of the case, relevant provisions of the Personal Data (Privacy) Ordinance, explanation provided by the Company, investigation result, remedies taken by the Company, and the Commissioner’s view.

5. The Company was found sending out mass mailing in a promotional activity asking people to provide their personal information, including name, sex, HKID card number, correspondence address, email address (optional), telephone number, name of employing company, position category, and age and income groups, in return for a $20 gift coupon upon verification.

6. Having considered all the circumstances of the case, the Commissioner concluded that the Company had collected from the applicants excessive personal data, i.e. ID card number and name of employing company and thus had contravened the requirements of DDP1(1) and paragraph 2.3 of the Code of Practice on the Identity Card Number and other Personal Identifiers.

7. After the commencement of the investigation, the Company had deleted the information on ID card number and name of the employing company collected in the promotional activity; and ceased collecting ID card number, other personal identifiers and name of employing company in similar promotional activities.

8. Copies of the Commissioner’s Report can be obtained from the Commissioner's Office at 12/F., 248 Queen's Road East, Wan Chai, Hong Kong.  The report is also available for download from his website (http://www.pcpd.org.hk/english/publications/invest_report.html).



END