個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

Complaint Case Notes
Print

No: 0003/2012/IP

Title: Client’s objection in receiving Promotional SMS

Reason: Complaint

Brief:

    In order to receive discount while shopping at Company A, Resident X provided his name and phone number in order to join its membership.  Since then, Company A continued to send promotional SMS to X.  Subsequently, feeling very disturbed, X called Company A and expressed to refuse any further promotional SMS. However, the SMS continued, so X requested the GPDP to follow up.

Analysis:

 
  In accordance with the Articles 4(1)(1) and 3(1) of the Personal Data Protection Act (PDPA, or Law 8/2005), the data processing in this case is within the scope of regulation by the said Law.
  Company A replied that the company normally registered a customer’s name and phone number after his purchase, which means the Company will input his data into its membership database.  When someone refused to receive promotional SMS, the company would then delete his data records from the database.
  The GPDP is in the opinion that Company A is the controller since it has the power to process the membership data in the database, to send SMS, to decide the content of the promotional SMS, to delete membership records, and others.
  As regard sending advertising SMS, the PDPA laid down the OPT-IN principle, i.e., consent of a data subject should be obtained before sending promotional SMS.  In order to join the membership, X voluntarily offered his name and phone number to Company A, who also informed verbally that promotional SMS would be sent out. Thus, such practice conforms with the legitimacy stated in Article 6 of the PDPA.  Within the ensuing years, X received promotional SMS sent by Company A, but he has never questioned the legitimacy of such practice.  Later, X felt disturbed by the frequent SMS and asked Company A to stop texting him anymore. It can be concluded that X was only exercising his right to object, instead of disagreeing to receive the promotional SMS.  So far, no evidence showed that Company A has violated Article 6 of the PDPA.
  And later, Company A replied, in writing, saying that a customer called and requested to refuse receiving promotional SMS.  But this customer refused to provide his name and contact number, therefore, the right to object was not fully exercised.  The GPDP is in the opinion that there is a contradiction between the statements of X and Company A.  As X failed to provide evidence, therefore, the GPDP closed the case in September 2012, and sent a letter to Company A.  The GPDP informed this Company of  X’s complaint, saying that he refused to receive promotional SMS, at the same time provided the phone number of X and reminded Company A that it should not send promotional messages before obtaining the unambiguous consent of a data subject.  Furthermore, it was told to establish a list of customers that refused to receive such messages. Subsequently, Company A made another reply, saying that the X’s contact number has been deleted from the record, and promised not to send further promotional SMS to X.
  But X, again, received promotional SMS in October 2012 and February 2013 from Company A.  It can be concluded that Company A failed to ensure the right to object of X and ignored the recommendations of the GPDP as mentioned in its reply.
  In summary, Company A violated Paragraph 2 of Article 12 of the Personal Data Protection Act.

Result:

    Taking into account the following factors: 1. it is the first time that Company A violated the PDPA; 2. the company received complaints from only one customer; 3. the company failed to keep its promise of deleting the records of the phone number of X; and the company failed more than once to ensure the right to object of X.  Based on these, the GPDP decided to impose to Company A a penalty of MOP 6,000, in accordance with Article 33(1) of the PDPA.  The punishment has been implemented.
  The GPDP already officially informed Company A and X of the above analysis and decision.

Reference:
Please refer to "Personal Data Protection Act", articles 3, 4, 6, 12 and 33 .

Back

Avenida da Praia Grande, N.º 804, Edif. China Plaza, 17.º andar, Macau Tel:(853) 2871 6006 Fax:(853) 2871 6116