### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35L. Data subject may require data user to cease to provide personal data for use in direct marketing
(1) A data subject who has been provided with information by a data user under section 35J(2)(b) may, at any time, require the data user—
(a) to cease to provide the data subject’s personal data to any other person for use by that other person in direct marketing; and
(b) to notify any person to whom the data has been so provided to cease to use the data in direct marketing.
(2) Subsection (1) applies irrespective of whether the data subject has earlier given consent to the provision of the personal data.
(3) A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data subject, comply with the requirement.
(4) If a data user is required to notify a person to cease to use a data subject’s personal data in direct marketing under a requirement referred to in subsection (1)(b), the data user must so notify the person in writing.
(5) A person who receives a written notification from a data user under subsection (4) must cease to use the personal data in direct marketing in accordance with the notification.
(6) A data user who contravenes subsection (3) commits an offence and is liable on conviction—
(a) if the contravention involves a provision of personal data of a data subject for gain, to a fine of $1,000,000 and to imprisonment for 5 years; or
(b) in any other case, to a fine of $500,000 and to imprisonment for 3 years.
(7) A person who contravenes subsection (5) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years.
(8) In any proceedings for an offence under subsection (6) or (7), it is a defence for the data user or person charged to prove that the data user or person took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
(9) This section does not affect the operation of section 26.

35M. Prescribed consent for providing personal data for use in direct marketing under data protection principle 3
Despite section 2(3), where a data user requires, under data protection principle 3, the prescribed consent of a data subject for providing any personal data of the data subject to another person for use in direct marketing, the data user is to be taken to have obtained the consent if the data user has not contravened section 35J, 35K or 35L.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

36. Inspections of personal data systems
Without prejudice to the generality of section 38, the Commissioner may carry out an inspection of—
(a) any personal data system used by a data user; or
(b) any personal data system used by a data user belonging to a class of data users,
for the purposes of ascertaining information to assist the Commissioner in making recommendations—
(i) to—
(A) where paragraph (a) is applicable, the relevant data user;
(B) where paragraph (b) is applicable, the class of data users to which the relevant data user belongs; and
(ii) relating to the promotion of compliance with the provisions of this Ordinance, in particular the data protection principles, by the relevant data user, or the class of data users to which the relevant data user belongs, as the case may be.

37. Complaints
(1) An individual, or a relevant person on behalf of an individual, may make a complaint to the Commissioner about an act or practice—
(a) specified in the complaint; and
(b) that—
(i) has been done or engaged in, or is being done or engaged in, as the case may be, by a data user specified in the complaint;
(ii) relates to personal data of which the individual is or, in any case in which the data user is relying upon an exemption under Part 8, may be, the data subject; and
(iii) may be a contravention of a requirement under this Ordinance (including section 28(4)).
(2) Where 2 or more individuals may each make a complaint about the same act or practice, then any of those individuals, or any relevant person on behalf of any of those individuals, may make such a complaint on behalf of all those individuals, and the provisions of this Ordinance (including subsection (1)) shall be construed accordingly.
(3) A complaint shall be—
(a) in writing in the Chinese or English language; or
(b) in such other form as the Commissioner may accept.
(4) It shall be the duty of the Commissioner and each prescribed officer who has been employed under section 9(1)(a) to provide appropriate assistance to an individual, or a relevant person on behalf of an individual, who wishes to make a complaint and requires assistance to formulate the complaint.
(Amended E.R. 1 of 2013)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

38. Investigations by Commissioner
Where the Commissioner—
(a) receives a complaint; or
(b) has reasonable grounds to believe that an act or practice—
(i) has been done or engaged in, or is being done or engaged in, as the case may be, by a data user;
(ii) relates to personal data; and
(iii) may be a contravention of a requirement under this Ordinance,

then—
(i) where paragraph (a) is applicable, the Commissioner shall, subject to section 39, carry out an investigation in relation to the relevant data user to ascertain whether the act or practice specified in the complaint is a contravention of a requirement under this Ordinance;
(ii) where paragraph (b) is applicable, the Commissioner may carry out an investigation in relation to the relevant data user to ascertain whether the act or practice referred to in that paragraph is a contravention of a requirement under this Ordinance.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

40. Commissioner may carry out or continue investigation initiated by complaint notwithstanding withdrawal of complaint
Where the Commissioner is of the opinion that it is in the public interest so to do, he may carry out or continue an investigation initiated by a complaint notwithstanding that the complainant has withdrawn the complaint and, in any such case, the provisions of this Ordinance shall apply to the complaint and the complainant as if the complaint had not been withdrawn.

41. Commissioner to inform relevant data user of inspection or investigation
(1) The Commissioner shall, before carrying out an inspection or, subject to subsection (2), an investigation, by notice in writing served on the relevant data user, inform the data user of his intention to carry out the inspection or investigation, as the case may be.
(2) The Commissioner is not required to comply with subsection (1) in the case of any investigation in respect of which he has reasonable grounds to believe that to so comply may prejudice the purposes of the investigation.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

43. Proceedings of Commissioner
(1) Subject to the provisions of this Ordinance, the Commissioner may, for the purposes of any investigation—
(a) be furnished with any information, document or thing, from such persons, and make such inquiries, as he thinks fit; and
(b) regulate his procedure in such manner as he thinks fit.
(2) Any hearing for the purposes of an investigation shall be carried out in public unless—
(a) the Commissioner is of the opinion that, in all the circumstances of the case, the investigation should be carried out in private; or
(b) if the investigation was initiated by a complaint, the complainant requests in writing that the investigation be carried out in private.
(3) Counsel and solicitors shall not have any right of audience before the Commissioner at any hearing for the purposes of an investigation, but may appear before him if he thinks fit.
(4) It shall not be necessary for the Commissioner to hold any hearing for the purposes of an investigation and no person shall be entitled to be heard by the Commissioner.
(5) If at any time during the course of an investigation it appears to the Commissioner that there may be sufficient grounds for him to make any report or recommendation that may criticize or adversely affect any person he shall give to the person an opportunity to be heard.