A quality database with personal information is one of the key components for successful Direct Mail campaigns. However, privacy of personal data is a major concern of the general public, not just in Hong Kong, but worldwide. In fact, personal data is not just required by Direct Mail marketers, it is also an essential operating element of many industries, including banking, insurance, publishing, medical, etc. These industries also require frequent data transfer between Hong Kong and many other countries and regions that have data protection laws.

In 1996, the Hong Kong authorities, after consulting the business community, the public, and many trade organizations (including the Hong Kong Direct Marketing Association) put into effect a law to keep a fair balance between legitimate commercial needs and personal privacy protection. The Personal Data (Privacy) Ordinance (Hong Kong Law Chapter 486) was brought into force on December 20, 1996.

The purpose of the Ordinance is to protect the privacy interests of living individuals in relation to personal data. It also contributes to Hong Kong's continued economic well-being by safeguarding the free flow of personal data to Hong Kong from restrictions by countries and regions that already have data protection laws.

Scope of Coverage
The Ordinance covers any data relating directly or indirectly to a living individual (data subject), from which it is practicable to ascertain the identity of the individual and which are in a form in which access or processing is practicable. It applies to any person (data user) that controls the collection, holding, processing or use of personal data.

Implications for Data Users and Data Subjects
Data users must follow the fair information practices stipulated in the data protection principles in the Ordinance.

The Ordinance gives rights to data subjects. They have the right to confirm with data users whether their personal data are held, to obtain a copy of such data, and to have personal data corrected. Any charge for providing a copy of personal data to a data subject may not be excessive. They may complain to the Privacy Commissioner for Personal Data about a suspected breach of the Ordinance's requirements and claim compensation for damage caused to them as a result of a contravention of the Ordinance through civil proceedings.

The Privacy Commissioner for Personal Data
The Personal Data (Privacy) Ordinance is administered by the Privacy Commissioner of Personal Data who is appointed by the Chief Executive. Among many duties, the Commissioner is responsible for promoting the awareness and understanding of the Ordinance's requirements, issuing codes of practice, and investigation of suspected breaches of the Ordinance.

Note for Direct Marketers:
The Personal Data Privacy Ordinance in relations to Direct Marketing (Section 35) has been amended with effect on 1 April 2013. Offences against the Law could lead to significant fines and imprisonment. Please refer to the Guidance Note issued by Office of the Privacy Commissioner for Personal Data, Hong Kong.

back to top ^