Complaint Case Notes

編號: 0014/2015/IP

標題: Cold calling non-customer individual

立案原因: Complaint


    The Complainant of the current case is not a customer of Company A, but received cold calls and text messages, relating to property for sale, from this Company.  Believing that it was a suspected violation of the Personal Data Protection Act (PDPA or Law 8/2005), the Complainant asked the Office for Personal Data Protection (GPDP) to follow up. 


    As regards the application of the PDPA, under its Article 4(1)(1) and 3(1) the data processing of the current case is subject to this Law. 
  Company A explained that the Complainant provided his number once, in order to ask for property sale information.  Considering that the processing purposes with regard to direct marketing differ from that relating to the services for real estate intermediation, the legitimacy of Company A’s marketing should be analyzed independently, even if what it indicated was the truth. 
  Article 6 of the PDPA governs that processing of non-sensitive personal data is legitimate, provided that any of the criteria stipulated therein is met.  Generally the processing of personal data by commercial enterprises for marketing purposes should respect and safeguard the rights of the data subjects by adhering to the opt-in principle (“prior consent” or “accepted to receive”) as adopted by the PDPA.  With this principle explicit consent from data subjects should be received in advance, otherwise the processing is not legitimate according to the Law.  Since Company A had not obtained consent from the Complainant before cold calling him or sending unsolicited messages, it failed to achieve the criterion of legitimate processing pursuant to Article 6 of the PDPA. 
  On the other hand, after the Complainant had refused further marketing calls or messages while having dialogues with Company A, the latter also immediately deleted the former’s information from its database.  Since then, the Complainant has not received any unsolicited marketing approaches from this Company.  Based on the fact that Company A safeguarded the right to object, as exercised by the Complainant, therefore Article 12(2) of the PDPA was not violated. 


    Taking into account that Company A has formulated personal data processing guidelines and deleted the Complainant’s information following his exercise of the right to object, in addition that it was an initial violation and its cooperativeness during the investigation, the GPDP decided to impose a penalty of MOP8000 to Company A according to Article 33(2) of the PDPA on the grounds that it violated Article 6 of the same Law by failing to achieve the criteria for legitimate processing.
  The GPDP informed the Complainant and Company A of the investigation results, and also reminded Company A to establish its own opt-out list, as a reminder to its staff for not contacting the data subjects on the list for any marketing information. 

Please refer to Article 3, 4, 6, 12 and 33 of the Personal Data Protection Act.