Hong Kong Personal Data (Privacy) Ordinance (PDPO, Cap 486) HK-PDPO-DPP3-Use-Direct-Marketing-Consent-Section-35: HK PDPO DPP3 Use Limitation Principle + Direct Marketing Prescribed Consent (Sections 35A-N)

Schedule 1 DPP3 Data Use Principle requires personal data shall not without prescribed consent of the data subject be used for a new purpose (any purpose other than the original purpose for which it was collected or a directly related purpose). 2012 amendments introduced Part 6A Direct Marketing regime (Sections 35A-N) imposing additional layer on use of personal data for direct marketing. Before using personal data in direct marketing, data user must: provide notification (kinds of data to be used + classes of marketing subjects) in easily understandable + readable manner, obtain explicit indication of consent (opt-in style not opt-out), provide channel to withdraw consent at any time without charge, cease use upon receiving opt-out within reasonable time. Before transferring personal data to another person for use in direct marketing, additional notification + written consent + record-keeping requirements apply (Section 35J + 35K). Criminal penalties under Section 35E (HKD 500,000 + 3 years imprisonment for use without prescribed consent), Section 35J (HKD 1,000,000 + 5 years for transfer for gain), Section 35L (HKD 500,000 for ignoring opt-out). PCPD New Guidance on Direct Marketing 2013 + updates. HK PDPO DPP3 + Direct Marketing + Sections 35A-N + prescribed consent + opt-in + opt-out + criminal penalties applies.