Personal Data (Privacy) Ordinance Part 6A—Division 2 6A-14 Section 35F Cap. 486 (a) the personal data falls within a permitted kind of personal data; and (b) the marketing subject in relation to which the data is used falls within a permitted class of marketing subjects. (3) A data subject may communicate to a data user the consent to a use of personal data either through a response channel or other means. (4) A data user who contravenes subsection (1) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years. (5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence. 35F. Data user must notify data subject when using personal data in direct marketing for first time (1) A data user must, when using a data subject’s personal data in direct marketing for the first time, inform the data subject that the data user must, without charge to the data subject, cease to use the data in direct marketing if the data subject so requires. (2) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data user. (3) A data user who contravenes subsection (1) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years. (4) In any proceedings for an offence under subsection (3), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence. Verified Copy Last updated date 5.12.2014