Personal data law's selling point is much tighter rules on privacy
Mark Parsons, of Freshfields Bruckhaus Deringer, looks at how new regulations affect business use of consumers' personal details
The Octopus Rewards affair in summer 2010 brought the issue of data privacy home to Hong Kong. The follow-on from Octopus Rewards is Hong Kong's long-awaited data privacy reforms, which took effect on October 1 this year.
Much of the legislative reforms have focused on tightening the rules around using personal data for marketing purposes, a clear response to revelations that Octopus Rewards' loyalty scheme sold personal data for marketing purposes.
The new law will significantly step up compliance requirements in this area, forcing businesses to be much more explicit than they have been in the past about how they intend to make use of personal data.
The Privacy Commissioner for Personal Data, who oversees administration of privacy regulation in Hong Kong, expects to see a "tick box" approach in which consumers can opt not to receive e-mails, telephone calls and other kinds of marketing.
Businesses will have to fully inform individuals of the nature of the personal data that will be used in the marketing and the type of products and services that will be marketed. Where these are not the same or directly related to products or services previously bought by the individuals, the nature of the products and services must be specifically referred to, for example "financial services" or "insurance" rather than generic terms like "our other products".