Complaint Case Notes

編號: 0112/2012/IP

標題: Company told the deliverer about the customer’s telephone number and address

立案原因: Report


    Resident J stated that he ordered bottled gas with Company A, and the deliverer mistakenly delivered another person’s order to his flat.  Then, another deliverer tried to send J’s order to his flat.  But after knowing that the bottled gas has been delivered, this deliver phoned J’s home and rasped that he would not deliver anymore to his flat if know it was his order.  The deliverer even spoke in a harsh manner.
  J believed that Company A should not have told the deliverer the customer’s phone number.  This made the deliverer’s processing of phone numbers deviated from the collecting purpose, thus J requested the Office for Personal Data Protection (GPDP) to follow up. 


  According to Article 4(1)(1) and Article 3(1) of the Personal Data Protection Act (PDPA), the data processing of the current case is regulated by the PDPA.
  According to the reply of Company A, it stated that the contact data (including the customers’ phone numbers and addresses) would be told to the deliverer for contacting the customers and delivering the bottled gas.  In the employment contract, it has clearly specified that no customer’s data should be disclosed to any third parties.
  The GPDP is of the view that, J provided the contact data for the bottled gas delivery.  Thus, Company A has the legitimacy in handling the relevant data pursuant to Article 6 of the PDPA, regarding the clear consent of the data subject and contract performance.
  Company A and the customers have contractual relationships.  Customers provided their address and contact number to Company A while ordering the bottled gas to be delivered.  Based on the purposes to notify the customer the delivery time and confirming the customer’s address, Company A has informed the deliverer the said data.
  Hence, in order to achieve the said purposes, it is necessary for Company A and the deliverer to processes the customer’s personal data.  In addition, if such data was not used for any other purposes, this complies with Article 5 of the PDPA.  As to the deliver’s harsh manner, this would depend on how Company A handled the customer complaint of its deliverers, which the GPDP is not required to follow-up.  Company A expressed that staff trainings would be reinforced.
  Overall, Company A has not violated the PDPA when processing the customer’s personal data.


    The GPDP has informed Company A and J regarding the handling result, and suggested Company A establish internal guidelines and reinforce staff trainings.  This case has been closed.

Please refer to "Personal Data Protection Act", articles 3, 4, 5 and 6.