Personal Data (Privacy) Ordinance Part 6A—Division 2 6A-16 Section 35G Cap. 486 35G. Data subject may require data user to cease to use personal data in direct marketing (1) A data subject may, at any time, require a data user to cease to use the data subject’s personal data in direct marketing. (2) Subsection (1) applies irrespective of whether the data subject— (a) has received from the data user the information required to be provided in relation to the use of personal data under section 35C(2); or (b) has earlier given consent to the data user or a third person to the use. (3) A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data subject, comply with the requirement. (4) A data user who contravenes subsection (3) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years. (5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence. (6) This section does not affect the operation of section 26. 35H. Prescribed consent for using personal data in direct marketing under data protection principle 3 Despite section 2(3), where a data user requires, under data protection principle 3, the prescribed consent of a data subject for using any personal data of the data subject in direct marketing, the data user is to be taken to have obtained the consent if the data user has not contravened section 35C, 35E or 35G. Verified Copy Last updated date 5.12.2014