Guidance on Sharing Customer Data by Authorized Institutions for Direct Marketing by Third Parties

Our Ref: B1/15C B9/67C 19 November 2021 The Chief Executive All Authorized Institutions Dear Sir / Madam, Guidance on Sharing Customer Data by Authorized Institutions for Direct Marketing by Third Parties I am writing to provide guidance to authorized institutions (“AIs”) on sharing of customers’ personal data with third parties, including group companies of AIs (collectively referred to as “third parties”), for direct marketing by such third parties, following industry consultation. While AIs collect personal data of customers through online channels including mobile apps for their own operational and direct marketing purposes, there are increasing occasions that AIs may also provide such personal data collected to third parties such that the third parties may use such personal data for their own direct marketing purpose. Given the special trust relationship between AIs and their customers, and considering that some of the third parties are not subject to any regulatory regime like that of AIs, for the sake of better safeguarding personal data of banking customers, the Hong Kong Monetary Authority (“HKMA”) considers that the banking industry should aspire to a higher standard regarding sharing of customers’ personal data with third parties for the purpose of direct marketing. Under the guidance, there are two general approaches that AIs may adopt for sharing customers’ personal data for direct marketing by third parties: (i) by asking customers to directly approach the third parties such that the customers

• 2 - may provide their personal data directly to the third parties; or (ii) redirecting the customers from AIs’ website / mobile apps to the websites / mobile apps of the third parties (“redirection”) for provision of their personal data and/or consent for direct marketing by such third parties. The guidance also stipulates how redirection should be made, the types of customers’ personal data that may be shared with third parties in different circumstances under the redirection approach, and other guiding principles on the sharing of customers’ personal data to third parties. Detailed guidance is contained in the Annex. Implementation The guidance will take effect on 1 January 2022 such that any new applicable initiativesto be launched by AIs from that date should comply with the guidance. For AIs’ existing applicable arrangements, AIs are expected to comply with the guidance as soon as practicable and in any case not later than 6 months from the effective date (i.e. by 30 June 2022). If you have any questions on this circular, please contact Mr Ken Lee on 2878- 1357 or Ms Kacey Chan on 2878-8310. Yours faithfully, Alan Au Executive Director (Banking Conduct) Encl. c.c. Office of the Privacy Commissioner for Personal Data (Attn: Ms Ada Chung, Privacy Commissioner for Personal Data)