Complaint Case Notes

編號: 0103/2012/IP

標題: Legitimacy to get personal data

立案原因: Complaint


    Citizen A indicated that he received promotional / cold calls from Shop K (calling from number 633XXXX and 633XXXX). Even after A refused the sales promotion, the cold calls continued.
  A questioned the legitimacy Shop K established to obtain his data, and indicated that it also failed to respect his right to object. He believed that Shop K violated the Personal Data Protection Act (PDPA, or Law 8/2005) and requested the Office for Personal Data Protection (GPDP) to follow up.


    According to Article 4(1)(1) and Article 3(1) of the PDPA, data processing of the current case is subject to the same Law.
  According to GPDP’s investigation, Shop K is a cosmetic brand, which is subordinate to Company B. Company B is the parent company registered in Hong Kong and has set up a subsidiary in Macau, under the registered business name Company C.
  The GPDP obtained the telephone number of Company C from a public source, and sent a letter to Bureau D to enquire whether the Company called A.  According to the reply, no concerned call records were retrieved. The GPDP sent a letter to Telecommunication Company E to verify the identities of the registered users of the mentioned numbers. The company replied that these numbers were not local numbers, and thus it could not provide any information on the user identities.  
  According to Company C’s reply, the group did not make any cold calls to A, and also he not its members.  L, the manager of Company B, stated that the numbers previously mentioned are not used by Company B or Company C.  Shop K was a brand that marketed by both these companies. Both the Hong Kong parent company and the Macao subsidiary conduct marketing activities through advertisements (TV and magazines) and recommendations made by their customers to others, and they did not promote their business through cold calls.  When it is necessary to call any customers, the Macao subsidiary would call with the number of Company K’s branch and in the name of Company K, whereby no caller ID was concealed. When any person applied to become a customer, in addition to the membership application form, he/she is also required to fill out a declaration to signify whether to receive promotional information. Only after one has specified his wish to receive, Company K would make promotional calls or send messages.  A failed to provide any evidence, and thus the GPDP is in the opinion that at present Company C did not make the cold calls nor processed A’s personal data.
  As A mentioned that the cold calls from Company K continued even after exercising his right to object, no evidence suggested that Company C, which carried out the promotional activities for the former, continued making cold calls even the right to object was exercised. According to Company B’s information, when someone refused the continuous processing of his personal data, it would include this person onto the opt-out list in order to discontinue the promotional calls and messages. For the above no evidence at present showed that Company C violated the right to object which Article 12 of the PDPA governed.
  To sum up, no evidence showed that Company C violated the PDPA.


    This case was closed.  The investigation result has been informed to Company C and A.  The former was recommended to effectively implement its [privacy] policies in order to guarantee the right to object of data subjects.

Please refer to “Personal Data Protection Act”, articles 3, 4, and 12.