Personal Data (Privacy) Ordinance Part 6A—Division 3 6A-22 Section 35K Cap. 486 (b) if the data is provided otherwise than for gain, to a fine of $500,000 and to imprisonment for 3 years. (6) In any proceedings for an offence under subsection (5), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence. 35K. Data user must not provide personal data for use in direct marketing without data subject’s consent (1) A data user who has complied with section 35J must not provide the data subject’s personal data to another person for use by that other person in direct marketing unless— (a) the data user has received the data subject’s written consent to the intended provision of personal data, as described in the information provided by the data user under section 35J(2)(b), either generally or selectively; (b) if the data is provided for gain, the intention to so provide was specified in the information under section 35J(2)(b)(i); and (c) the provision is consistent with the data subject’s consent. (2) For the purposes of subsection (1)(c), the provision of personal data is consistent with the data subject’s consent if— (a) the personal data falls within a permitted kind of personal data; (b) the person to whom the data is provided falls within a permitted class of persons; and (c) the marketing subject in relation to which the data is to be used falls within a permitted class of marketing subjects. Verified Copy Last updated date 5.12.2014