Personal Data (Privacy) Ordinance Part 6A—Division 3 6A-26 Section 35L Cap. 486 (4) If a data user is required to notify a person to cease to use a data subject’s personal data in direct marketing under a requirement referred to in subsection (1)(b), the data user must so notify the person in writing. (5) A person who receives a written notification from a data user under subsection (4) must cease to use the personal data in direct marketing in accordance with the notification. (6) A data user who contravenes subsection (3) commits an offence and is liable on conviction— (a) if the contravention involves a provision of personal data of a data subject for gain, to a fine of $1,000,000 and to imprisonment for 5 years; or (b) in any other case, to a fine of $500,000 and to imprisonment for 3 years. (7) A person who contravenes subsection (5) commits an offence and is liable on conviction to a fine of $500,000 and to imprisonment for 3 years. (8) In any proceedings for an offence under subsection (6) or (7), it is a defence for the data user or person charged to prove that the data user or person took all reasonable precautions and exercised all due diligence to avoid the commission of the offence. (9) This section does not affect the operation of section 26. Verified Copy Last updated date 5.12.2014