Complaint Case Notes

編號: 0187/2014/IP

標題: A company sent promotional messages to its members

立案原因: Complaint


    The Complainant of the current case applied for the membership of Company A in order to enjoy its discount program.  The choices for applicants to accept or refuse promotional messages, however, were not available on the application forms.  Afterwards, the Complainant received quite a number of unsolicited messages from Company A and believed that this was a violation of the Personal Data Protection Act (PDPA).


    In this case, the Complainant provided his name, address and mobile number when applying from Company A.  Pursuant to Article 4(1)(1) and 3(1) of the PDPA, its processing of personal data is subject to the PDPA.
  Company A pointed out that the messages it sent out were not of marketing purpose, but to inform its members of the discount benefits.  The purpose of sending out such messages, however, was to provide more information with regard the discounts available and to encourage consumer spending—all relating to its promotions.  In other words, the said messages are of promotional nature.  Since one does not necessarily produce the said messages when using his membership card; therefore they are not equivalent to the purpose of providing services to members and Company A should fulfil other legal requirements in order to legitimize its data processing.
  Article 6 of the PDPA provides that so long as a data controller fulfills any of the conditions of legitimate processing specified therein, personal data processing is allowed.  Normally when commercial institutions, for promotional and marketing purposes, process personal data, they should respect and guarantee the rights of the data subjects by first acquiring their unambiguous consent.  On the contrary, data processing is not legitimate if without consent.  Since choices were not made available to applicants, for receiving promotional messages or not, during application, Company A failed to legitimize its data processing under Article 6 of the PDPA. 
  On the other hand, the Complainant has not received further promotional messages after he exercised his right to object.  This revealed that Company A guaranteed such right enjoyed by the Complainant and did not violate Article 12(2) of the PDPA.  


    Considering that the application form was changed to allow applicants to select the choices to receive or refuse promotional messages afterwards—which was a guarantee offered by Company A to its members’ right to object—and this was its initial violation and the cooperativeness found during investigation, the GPDP decided to impose a penalty of MOP$8000.The punishment was based on Article 33(2) of the PDPA for a violation of Article 6 of the same Law, on the basis that Company A had not fulfilled the conditions of legitimate processing before sending out promotional messages to its members.
  The GPDP has already informed Company A and the Complainant the investigation result. 

Please refer to Article 3, 4, 6, 12 and 33 of the Personal Data Protection Act.