On 4 December 2014, an insurance agent was sentenced to jail for 4 weeks for a contravention of section 50B(1)(c)(i) under the Personal Data (Privacy) Ordinance, Cap. 486 of the Laws of Hong Kong (“PDPO”). Under the said provision, a person commits an offence if he makes a statement to the Privacy Commissioner (“Commissioner”) which he knows is false or does not believe to be true or knowingly mislead the Commissioner, and is liable for a maximum fine of HK$10,000 and 6 months’ imprisonment.
The case followed a complaint lodged by an individual to the Office of the Commissioner claiming that the insurance agent had obtained her personal data through unfair means. During the investigation, the insurance agent falsely represented to the Commissioner that he had been assigned to work with the complainant when he was employed by his then employer which was denied by the employer. The insurance agent was convicted for the contravention of the said section 50B(1)(c)(i) of PDPO.
In addition to the above, other non-compliances of the PDPO may also lead to a prison sanction, such as:
1. Section 35C – use of personal data in direct marketing without taking specified action;
2. Section 35E – use of personal data for direct marketing without consent;
3. Section 50A – contravention of enforcement notice issued by the Commissioner; and
4. Section 64 – disclosure of personal data obtained without consent from data users with an intent to make a gain or to cause loss to the data subject or causing psychological harm to the data subject.
Given the first individual being sentenced to jail under PDPO, public and institutions should be more aware of the use of personal data and ensure compliance with the provisions in PDPO at all times.