### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35F. Data user must notify data subject when using personal data in direct marketing for first time
(1) A data user must, when using a data subject’s personal data in direct marketing for the first time, inform the data subject that the data user must, without charge to the data subject, cease to use the data in direct marketing if the data subject so requires.
(2) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data user.
(3) A data user who contravenes subsection (1) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years.
(4) In any proceedings for an offence under subsection (3), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.

35G. Data subject may require data user to cease to use personal data in direct marketing
(1) A data subject may, at any time, require a data user to cease to use the data subject’s personal data in direct marketing.
(2) Subsection (1) applies irrespective of whether the data subject—
(a) has received from the data user the information required to be provided in relation to the use of personal data under section 35C(2); or
(b) has earlier given consent to the data user or a third person to the use.
(3) A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data subject, comply with the requirement.
(4) A data user who contravenes subsection (3) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years.
(5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
(6) This section does not affect the operation of section 26.

35H. Prescribed consent for using personal data in direct marketing under data protection principle 3
Despite section 2(3), where a data user requires, under data protection principle 3, the prescribed consent of a data subject for using any personal data of the data subject in direct marketing, the data user is to be taken to have obtained the consent if the data user has not contravened section 35C, 35E or 35G.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35I. Application
(1) This Division does not apply if a data user provides, otherwise than for gain, personal data of a data subject to another person for use by that other person in offering, or advertising the availability, of—
(a) social services run, subvented or subsidized by the Social Welfare Department;
(b) health care services provided by the Hospital Authority or Department of Health; or
(c) any other social or health care services which, if not provided, would be likely to cause serious harm to the physical or mental health of—
(i) the individual to whom the services are intended to be provided; or
(ii) any other individual.
(2) This Division does not apply if a data user provides personal data of a data subject to an agent of the data user for use by the agent in carrying out direct marketing on the data user’s behalf.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35J. Data user to take specified action before providing personal data
(1) A data user who intends to provide a data subject’s personal data to another person for use by that other person in direct marketing must take each of the actions specified in subsection (2).
(2) The data user must—
(a) inform the data subject in writing—
(i) that the data user intends to so provide the personal data; and
(ii) that the data user may not so provide the data unless the data user has received the data subject’s written consent to the intended provision;
(b) provide the data subject with the following written information in relation to the intended provision—
(i) if the data is to be provided for gain, that the data is to be so provided;
(ii) the kinds of personal data to be provided;
(iii) the classes of persons to which the data is to be provided; and
(iv) the classes of marketing subjects in relation to which the data is to be used; and
(c) provide the data subject with a channel through which the data subject may, without charge by the data user, communicate the data subject’s consent to the intended provision in writing.
(3) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data user.
(4) The information provided under subsection (2)(a) and (b) must be presented in a manner that is easily understandable and easily readable.
(5) A data user who provides personal data of a data subject to another person for use by that other person in direct marketing without taking each of the actions specified in subsection (2) commits an offence and is liable on conviction—
(a) if the data is provided for gain, to a fine of $1,000,000 and to imprisonment for 5 years; or
(b) if the data is provided otherwise than for gain, to a fine of $500,000 and to imprisonment for 3 years.
(6) In any proceedings for an offence under subsection (5), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35K. Data user must not provide personal data for use in direct marketing without data subject’s consent
(1) A data user who has complied with section 35J must not provide the data subject’s personal data to another person for use by that other person in direct marketing unless—
(a) the data user has received the data subject’s written consent to the intended provision of personal data, as described in the information provided by the data user under section 35J(2)(b), either generally or selectively;
(b) if the data is provided for gain, the intention to so provide was specified in the information under section 35J(2)(b)(i); and 
(c) the provision is consistent with the data subject’s consent.
(2) For the purposes of subsection (1)(c), the provision of personal data is consistent with the data subject’s consent if—
(a) the personal data falls within a permitted kind of personal data;
(b) the person to whom the data is provided falls within a permitted class of persons; and
(c) the marketing subject in relation to which the data is to be used falls within a permitted class of marketing subjects.
(3) A data subject may communicate to a data user the consent to a provision of personal data either through a response channel or other written means.
(4) A data user who contravenes subsection (1) commits an offence and is liable on conviction—
(a) if the data user provides the personal data for gain, to a fine of $1,000,000 and to imprisonment for 5 years; or
(b) if the data user provides the personal data otherwise than for gain, to a fine of $500,000 and to imprisonment for 3 years.
(5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.