A stricter regime for profiling07 June 2016
Investigation Into Car Park Management Company's Collection of Vehicle Owners' Registration Particulars for Direct Marketing
On 14 February 2012, the Hong Kong Privacy Commissioner (the "Commissioner") published a report (Report No. R12-3428, located at www.pcpd.org.hk/english/publications/files/R12_3428_e.pdf), on an investigation into Imperial Parking (HK) Limited ("Imperial"), a car park management firm that owns 50 car parks in Hong Kong, regarding its collection of motorists' registration particulars from the Transport Department's Register of Vehicles, and the subsequent use of this information for direct marketing purposes. Imperial's actions were found to contravene Data Protection Principles ("DPPs") 1(2) (relating to manner of collection of personal data) and 3 (relating to use of personal data) of Schedule 1 to the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").
The Commissioner launched an investigation into Imperial after a motorist (the "Complainant") complained about receiving a letter from the cark park management firm, promoting monthly parking privileges. This letter contained the Complainant's name, address and vehicle license plate number.
The Complainant had previously provided his personal details for car registration and licence application to the Transport Department, which maintains all such information in its Register of Vehicles ("Register"). Subsequently, an employee of Imperial (the "Employee") was instructed by his supervisor to obtain registration particulars relating to a batch of vehicle licence plate numbers (including the Complainant's) from the Register, to enable Imperial to distribute promotional material. To request access to such registration particulars, the Employee was required to complete the Application Form for a Certificate of Particulars of Motor Vehicle (the "Application Form"). This Application Form stipulated that any personal information obtained from the Register was to be used solely for activities relating to traffic and transport matters, and reminded applicants to provide true and complete information, or risk breaching Section 111(3) of the Road Traffic Ordinance (Cap. 374) ("RTO"). In addition to signing the Application Form to indicate acknowledgement of the foregoing stipulation, the Employee falsely stated on the Application Form that the purpose of the information request was "legal proceedings", when the actual purpose was for Imperial's promotional activities.
Given that the Employee obtained the registration particulars by providing a false statement, the Commissioner found that the means for collection were neither lawful nor fair in the circumstances of the case, such that Imperial contravened DPP1(2). In respect of Imperial's use of the Complainant's registration particulars for direct marketing, the Commissioner found a breach of DPP3, as Imperial had not used the registration particulars for the intended purposes of the Register. The Commissioner found no express statement of the Register's purpose, but considered that such purpose should be consistent with the aims of the RTO such that promotional / direct marketing purposes were clearly beyond the scope of these aims. The Commissioner also found Imperial's use of the registration particulars to fall beyond the reasonable expectations of the Complainant, given that: (i) vehicle owners providing their personal information for car registration and licence application would not be informed (on the relevant application form) that the purposes for the Transport Department collecting such information included its use for commercial promotion; and (ii) Imperial had not obtained the Complainant's prior consent to such use.
The Commissioner believed that the Employee's false statement used to obtain the registration particulars may have constituted a breach of section 111(3) of the RTO, which can result in a fine of HK$5,000 and 6 months' imprisonment. The Commissioner noted that Imperial, as the Employee's employer, could be held liable for the Employee's actions under s 65(1) of the PDPO as the Employee made the false statement in the course of his employment, as Imperial had instructed the Employee to obtain the registration particulars from the Register and Imperial had provided no guidance on how to complete the Application Form.
The Commissioner decided against serving an enforcement notice against Imperial (directing it to take specific steps to prevent future contraventions) in light of Imperial's subsequent moves to: (i) destroy the registration particulars obtained; (ii) undertake to refrain from searching the Registry for other registration particulars for promotional / direct marketing purposes in the future; and (iii) provide relevant internal guidelines for its staff, such that continued or repeated contravention of the PDPO was unlikely.
The Commissioner commented that plans were underway to amend the relevant regulations to specify the purpose of the Register and limit the circumstances in which registration particulars contained in the Register could be released, in order to plug existing loopholes.
Gabriela Kennedy (Partner), Hogan Lovells, Hong Kong, firstname.lastname@example.org, Heidi Gleeson (Registered Foreign Lawyer), Hogan Lovells, Hong Kong, email@example.com and Valerie Fung (Trainee), Hogan Lovells, Hong Kong, firstname.lastname@example.org
The Regulation aims to strengthen the rights of individuals. It does so by retaining rights that already exist under the Data Protection Directive and introducing the new rights of data...06 June 2016
Grounds for processing03 June 2016