### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35A. Interpretation of Part 6A
(1) In this Part—
consent (同意), in relation to a use of personal data in direct marketing or a provision of personal data for use in direct marketing, includes an indication of no objection to the use or provision;

direct marketing (直接促銷) means—
(a) the offering, or advertising of the availability, of goods, facilities or services; or
(b) the solicitation of donations or contributions for charitable, cultural, philanthropic, recreational, political or other purposes,

through direct marketing means;

direct marketing means (直接促銷方法) means—
(a) sending information or goods, addressed to specific persons by name, by mail, fax, electronic mail or other means of communication; or
(b) making telephone calls to specific persons;

marketing subject (促銷標的), in relation to direct marketing, means—
(a) any goods, facility or service offered, or the availability of which is advertised; or
(b) any purpose for which donations or contributions are solicited;

permitted class of marketing subjects (許可類別促銷標的), in relation to a consent by a data subject to an intended use or provision of personal data, means a class of marketing subjects—
(a) that is specified in the information provided to the data subject under section 35C(2)(b)(ii) or 35J(2)(b)(iv); and
(b) in relation to which the consent is given;

permitted class of persons (許可類別人士), in relation to a consent by a data subject to an intended provision of personal data, means a class of persons—
(a) that is specified in the information provided to the data subject under section 35J(2)(b)(iii); and
(b) in relation to which the consent is given;

permitted kind of personal data (許可種類個人資料), in relation to a consent by a data subject to an intended use or provision of personal data, means a kind of personal data—
(a) that is specified in the information provided to the data subject under section 35C(2)(b)(i) or 35J(2)(b)(ii); and
(b) in relation to which the consent is given;

response channel (回應途徑) means a channel provided by a data user to a data subject under section 35C(2)(c) or 35J(2)(c).
(2) For the purposes of this Part, a person provides personal data for gain if the person provides personal data in return for money or other property, irrespective of whether—
(a) the return is contingent on any condition; or
(b) the person retains any control over the use of the data.
(Amended E.R. 1 of 2013)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35B. Application
This Division does not apply in relation to the offering, or advertising of the availability, of—
(a) social services run, subvented or subsidized by the Social Welfare Department;
(b) health care services provided by the Hospital Authority or Department of Health; or
(c) any other social or health care services which, if not provided, would be likely to cause serious harm to the physical or mental health of—
(i) the individual to whom the services are intended to be provided; or
(ii) any other individual.

35C. Data user to take specified action before using personal data in direct marketing
(1) Subject to section 35D, a data user who intends to use a data subject’s personal data in direct marketing must take each of the actions specified in subsection (2).
(2) The data user must—
(a) inform the data subject—
(i) that the data user intends to so use the personal data; and
(ii) that the data user may not so use the data unless the data user has received the data subject’s consent to the intended use;
(b) provide the data subject with the following information in relation to the intended use—
(i) the kinds of personal data to be used; and
(ii) the classes of marketing subjects in relation to which the data is to be used; and
(c) provide the data subject with a channel through which the data subject may, without charge by the data user, communicate the data subject’s consent to the intended use.
(3) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data user.
(4) The information provided under subsection (2)(a) and (b) must be presented in a manner that is easily understandable and, if in written form, easily readable.
(5) Subject to section 35D, a data user who uses a data subject’s personal data in direct marketing without taking each of the actions specified in subsection (2) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years. 
(6) In any proceedings for an offence under subsection (5), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
(7) In any proceedings for an offence under subsection (5), the burden of proving that this section does not apply because of section 35D lies on the data user.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

35D. Circumstances under which section 35C does not apply
(1) If, before the commencement date—
(a) a data subject had been explicitly informed by a data user in an easily understandable and, if informed in writing, easily readable manner of the intended use or use of the data subject’s personal data in direct marketing in relation to a class of marketing subjects;
(b) the data user had so used any of the data;
(c) the data subject had not required the data user to cease to so use any of the data; and
(d) the data user had not, in relation to the use, contravened any provision of this Ordinance as in force as at the time of the use,

then section 35C does not apply in relation to the intended use or use, on or after the commencement date*, of the data subject’s relevant personal data, as updated from time to time, in direct marketing in relation to the class of marketing subjects.
(2) If—
(a) a data subject’s personal data is provided to a data user by a person other than the data subject (third person

35E. Data user must not use personal data in direct marketing without data subject’s consent
(1) A data user who has complied with section 35C must not use the data subject’s personal data in direct marketing unless—
(a) the data user has received the data subject’s consent to the intended use of personal data, as described in the information provided by the data user under section 35C(2)(b), either generally or selectively;
(b) if the consent is given orally, the data user has, within 14 days from receiving the consent, sent a written confirmation to the data subject, confirming—
(i) the date of receipt of the consent;
(ii) the permitted kind of personal data; and
(iii) the permitted class of marketing subjects; and
(c) the use is consistent with the data subject’s consent.
(2) For the purposes of subsection (1)(c), the use of personal data is consistent with the data subject’s consent if—
(a) the personal data falls within a permitted kind of personal data; and
(b) the marketing subject in relation to which the data is used falls within a permitted class of marketing subjects.
(3) A data subject may communicate to a data user the consent to a use of personal data either through a response channel or other means.
(4) A data user who contravenes subsection (1) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years.
(5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.