Personal Data (Privacy) Ordinance Part 6A—Division 3 6A-24 Section 35L Cap. 486 (3) A data subject may communicate to a data user the consent to a provision of personal data either through a response channel or other written means. (4) A data user who contravenes subsection (1) commits an offence and is liable on conviction— (a) if the data user provides the personal data for gain, to a fine of $1,000,000 and to imprisonment for 5 years; or (b) if the data user provides the personal data otherwise than for gain, to a fine of $500,000 and to imprisonment for 3 years. (5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence. 35L. Data subject may require data user to cease to provide personal data for use in direct marketing (1) A data subject who has been provided with information by a data user under section 35J(2)(b) may, at any time, require the data user— (a) to cease to provide the data subject’s personal data to any other person for use by that other person in direct marketing; and (b) to notify any person to whom the data has been so provided to cease to use the data in direct marketing. (2) Subsection (1) applies irrespective of whether the data subject has earlier given consent to the provision of the personal data. (3) A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data subject, comply with the requirement. Verified Copy Last updated date 5.12.2014