Complaint Case Notes

編號: 0114/2012/IP

標題: Continuously receiving promotion phone calls after exercising the right to object

立案原因: Report


    The GPDP received J’s report, stating that since 2010 he has continuously receiving promotional phone calls from Beauty Company A (hereinafter as Company A).  Once, the caller even knew his name when calling J.  Although J exercised the right to object, he kept receiving promotional calls.  When checking the source of the data, the calling party said once J purchased a cleansing lotion from Shop B and left his contact information.  J was sure that Shop B is not owned by Company A, and he has never joined the membership of Shop B.  J thus refused to receive the promotional calls again, but Shop B expressed that J had to visit its office to fill in a form to do so.
  J was of the view that Company A has violated the Personal Data Protection Act (PDPA, or Law 8/2005) and reported to the GPDP.


  According to Articles 4(1)(1) and 3(1) of the PDPA, the data processing in  this case is regulated by the PDPA.
  In Company A’s reply, it stated that J has collected a gift from Shop B’s trade fair counter and at the same time bought a cleansing product.  A staff member of Company A was working for the counter on an ad hoc basis, the contact number of J was taken for the after-sale services and the discounted beauty services.  Later, Company A and J kept in contact, and the personal email address of J was obtained during 2011.  However, since the said staff member has quitted the job for quite some years, it was thus difficult to prove the contents of their conversation.  In addition, the company would only call the customers when special offers were available during festivals.  In addition, staff guidelines were also available to the staff members.  When the customers refused receiving promotional phone calls, the staff would not contact them again.  When a customer exercised his right to object, he only has to call and inform the Company.  After J informed the company to stop contacting him in December 2012, it has not contacted J anymore.
  Pursuant to Article 6 of the PDPA, personal data may be processed by the data controller only if the data subject has unambiguously given his consent, for compliance with a legal obligation to which the controller is subject, etc.  According to the information from J and Company A, J was found voluntarily providing his information.  Thus, Company A had the legitimacy to process J’s personal data.  However, as to the scope of J’s consent, whether it covers receiving promotional materials sent by Company A is questionable.  Since the information was collected quite some years ago, as well as what happened was only found in the conversation between the two parties and the concerned staff member has also quitted the job, it is very difficult to prove what happened. 
  In addition, Company A also said that J has provided his email address to the Company in 2011.  This could be regarded as J agreed Company A to process his contact data for the purposes of contacting and promotion.  As such, the processing of J’s personal data by Company A complied with Article 6 of the PDPA.
  Article 12(2) of the PDPA stated that “the data subject also has the right to object, on request and free of charge, to the processing of personal data relating to him which the controller anticipates being processed for the purposes of direct marketing or any other form of commercial research, or to be informed before personal data are disclosed for the first time to third parties for the purposes of direct marketing or for use on behalf of third parties, and to be expressly offered the right to object free of charge to such disclosure or uses.”  On one hand, J and Company A verbally communicated and both parties failed to provide evidence (phone records, for example) for the said matters.  On the other, J also pointed out that he has not received any calls from Company A after he reported the current case, as well as Company A has only retained the record of J exercising his right to object made in December 2012.  Hence, no information showed that Company A failed to satisfy the customer’s right to object. 
  Having said that, although there is no proof showing that Company A, without legitimacy, sent the promotion material to its customer.  To reduce risks, Company A is suggested send such material after gaining the consent from customers, as well as allowing customers to choose on the form if receiving promotional material or not.  In addition, a list containing the customers that refused to receive such material could be established.


    Though no evidence proved that Company A has sent the promotional materials to the customers without legitimacy, to reduce risks the GPDP has recommended Company A send out promotional material only based on the data subjects’ consent.  In addition, its form should allow customers to choose if they want to receive promotional material and the list of refused customers as mentioned should be established. 
  To sum up, no information showed that Company A violated the Personal Data Protection Act, but room for improvement exists.  The current case has been closed.  The GPDP also notified J the investigation result and requested Company A to correct the problem.

Please refer to "Personal Data Protection Act", articles 3, 4, 6 and 12.