Investigation Into Car Park Management Company’s Collection of Vehicle Owners’ Registration Particulars for Direct Marketing

Background

The Commissioner launched an investigation into Imperial after a motorist (the "Complainant") complained about receiving a letter from the cark park management firm, promoting monthly parking privileges. This letter contained the Complainant’s name, address and vehicle license plate number.

The Complainant had previously provided his personal details for car registration and licence application to the Transport Department, which maintains all such information in its Register of Vehicles ("Register"). Subsequently, an employee of Imperial (the "Employee") was instructed by his supervisor to obtain registration particulars relating to a batch of vehicle licence plate numbers (including the Complainant’s) from the Register, to enable Imperial to distribute promotional material. To request access to such registration particulars, the Employee was required to complete the Application Form for a Certificate of Particulars of Motor Vehicle (the "Application Form"). This Application Form stipulated that any personal information obtained from the Register was to be used solely for activities relating to traffic and transport matters, and reminded applicants to provide true and complete information, or risk breaching Section 111(3) of the Road Traffic Ordinance (Cap. 374) ("RTO"). In addition to signing the Application Form to indicate acknowledgement of the foregoing stipulation, the Employee falsely stated on the Application Form that the purpose of the information request was "legal proceedings", when the actual purpose was for Imperial’s promotional activities.

Investigation Findings

Given that the Employee obtained the registration particulars by providing a false statement, the Commissioner found that the means for collection were neither lawful nor fair in the circumstances of the case, such that Imperial contravened DPP1(2). In respect of Imperial’s use of the Complainant’s registration particulars for direct marketing, the Commissioner found a breach of DPP3, as Imperial had not used the registration particulars for the intended purposes of the Register. The Commissioner found no express statement of the Register’s purpose, but considered that such purpose should be consistent with the aims of the RTO such that promotional / direct marketing purposes were clearly beyond the scope of these aims. The Commissioner also found Imperial’s use of the registration particulars to fall beyond the reasonable expectations of the Complainant, given that: (i) vehicle owners providing their personal information for car registration and licence application would not be informed (on the relevant application form) that the purposes for the Transport Department collecting such information included its use for commercial promotion; and (ii) Imperial had not obtained the Complainant’s prior consent to such use.

The Commissioner believed that the Employee’s false statement used to obtain the registration particulars may have constituted a breach of section 111(3) of the RTO, which can result in a fine of HK$5,000 and 6 months’ imprisonment. The Commissioner noted that Imperial, as the Employee’s employer, could be held liable for the Employee’s actions under s 65(1) of the PDPO as the Employee made the false statement in the course of his employment, as Imperial had instructed the Employee to obtain the registration particulars from the Register and Imperial had provided no guidance on how to complete the Application Form.

The Commissioner decided against serving an enforcement notice against Imperial (directing it to take specific steps to prevent future contraventions) in light of Imperial’s subsequent moves to: (i) destroy the registration particulars obtained; (ii) undertake to refrain from searching the Registry for other registration particulars for promotional / direct marketing purposes in the future; and (iii) provide relevant internal guidelines for its staff, such that continued or repeated contravention of the PDPO was unlikely.

Other Comments

The Commissioner commented that plans were underway to amend the relevant regulations to specify the purpose of the Register and limit the circumstances in which registration particulars contained in the Register could be released, in order to plug existing loopholes.

On the same day, the Commissioner released another investigation report on Hong Yip Service Company Limited’s ("Hong Yip") practice of using covert recording devices to monitor the performances of its employees. Two employees of Hong Yip lodged the complaint with the Commissioner’s office after being summarily dismissed on the ground of unauthorised absences from duty, discovered by Hong Yip through video recordings. The Commissioner found Hong Yip’s employee monitoring practice to be a contravention of DPP1(2) on the basis that the company could have chosen alternative, less privacy-intrusive data collection methods, and noted Hong Yip’s failure to develop a privacy policy on employee monitoring.

The Commissioner commented that covert means of employee monitoring should only be used when it is absolutely necessary and employers have no other alternative (such as where the employer reasonably suspects that an unlawful activity is being, or about to be, committed). The Commissioner recommends employers to formulate a privacy policy on employee monitoring (prior to engaging in such practice) in consultation with their employees, and to be mindful of the "Privacy Guidelines: Monitoring and Personal Data Privacy at Work", issued by the Commissioner’s office in 2004. 

Authored by Gabriela Kennedy.