I refer to L. Chang's letter ("People should have opt-in choice over personal data", April 16).
The Office of the Privacy Commissioner for Personal Data and the government undertook a review of the ordinance from 2009-2010, in the light of experience gained since it came into operation in 1996. One area reviewed was the regulation of the use of personal data in direct marketing.
As a result of the review and incidents that took place around that time, notably the Octopus incident, proposals were put forth for public consultation as to whether the regulation of the use of personal data in direct marketing and transfer of personal data to a third party for use in direct marketing should be tightened and, if so, how.
The views collected generally agreed that a balance needed to be struck between the protection of personal data privacy and allowing direct marketing activities; there were also different views on the form of the control regime, including whether an opt-in or opt-out regime should be adopted.
After considering all the views received, the government proposed that the opt-out mechanism should continue to be adopted, in step with the practices in most overseas jurisdictions and in line with public preference for an opt-out regime (as revealed by about 60 per cent of the submissions which expressed a view on this issue).
The government also proposed that some features of the control regime should be tightened to better protect the interests of data subjects. These include requiring the data user to clearly apprise the data subject of what data may be used and for what types of direct marketing, obtain the data subjects' consent/no-objection, and provide a free means for the data subject to indicate consent/no-objection. The purpose is to ensure that data subjects will be able to make informed choices.
These requirements, together with an exemption for personal data collected before their commencement and meeting certain criteria as well as amendments to other parts of the ordinance, were introduced into the Legislative Council in an amendment bill in July 2011, and passed by the council in June 2012 after close scrutiny. The new provisions relating to direct marketing came into force on April 1.
We trust the new provisions have struck the right balance between the protection of personal data privacy and allowing direct marketing activities. The Office of the Privacy Commissioner and the government will continue to monitor the implementation of the new requirements.
Philomena Leung, for secretary for constitutional and mainland affairs