The Eastern Magistrates' Court has fined DBS Bank Hong Kong HK$10,000, after finding the company guilty of failing to comply with a demand from a customer not to use his personal data in direct marketing.
The case was initiated by the Office of the Privacy Commissioner for Personal Data (PCPD) based on a complaint filed with the office in September 2015.
The complainant told the PCPD that he had applied for a loan at a DBS Bank branch in July 2014, filling out an application form requesting his name, Hong Kong ID card number and mobile number.
He also made an opt-out request, stating that he did not wish DBS Bank to use his personal data in direct marketing or receive any marketing materials from the bank.
But the complainant said he had received a phone call in June last year asking if he would like to apply for a further loan, and the caller hung up after asking why the call was made despite the opt out request.
In October, DBS Bank issued a letter admitting that its staff were not aware that the complainant's name and number were on the opt out list, apologizing for the incident and insisting it was an isolated one.
Despite the isolated nature of the incident, privacy commissioner for personal data Stephen Kai-yi Wong stressed the importance of effective and timely intra-office communications to ensure customers' privacy wishes are respected.
“Banks (as data users) should maintain a list of all customers who have indicated that they do not wish to receive further direct marketing materials. The head office also has to coordinate the updating of a consolidated Opt-Out List by collecting the opt-out information supplied by all branch offices,” he said.
“In this case, the staff member of DBS Bank was not aware of the complainant being included in the bank’s direct marketing Opt-Out List before using the latter’s mobile number for calling. To comply with the requirements of the Ordinance, DBS Bank should issue clear internal guidelines and provide appropriate training for its staff members to ensure their awareness of and compliance with the direct marketing provisions under the Ordinance.”