Selling privacy? | 24/7 adds direct-marketing “biometric data” clause, document says renewal counts as consent, then changes stance after complaints
健身「賣」私隱？｜24/7 增直銷「生物資料」條款 文件稱續會當同意 收投訴後改口
24/7 Fitness, a chain of gyms with more than 100 branches across Hong Kong that uses facial recognition as the sole entry-authentication procedure, sent members a letter last month adding an appendix to their existing contracts. The appendix reserved the company and its “associated persons” the right to use members’ biometric data for statistical or direct-marketing purposes. Staff at one branch said that even if members did not reply to the email, they would be deemed to have consented to the terms, and those who disagreed could only cancel their memberships. After a member complained to the Office of the Privacy Commissioner for Personal Data, 24/7 replied that biometric identification data would be used only for members’ entry to the premises. Former Privacy Commissioner and barrister Stephen Kai Yi Wong said that if a company uses personal data for a purpose different from that stated when the data was collected, and does so without separately obtaining the data subject’s express consent, it may constitute a breach. He also said that “treating non-reply as consent is not allowed.” After a member complained to the Office of the Privacy Commissioner for Personal Data, 24/7 changed its position and said it would not use members’ personal data for direct marketing without their express consent. The Privacy Commissioner’s Office said it had received two complaints about the incident and launched a compliance review at the end of last month. It wrote to the gym twice, awaiting a further response. The reporter emailed 24/7 for comment at the end of last month, but had received no reply by press time. The company commented on The Collective’s social media this afternoon, saying that it had sent the contract appendix to members at the direction of the Privacy Commissioner’s Office; members who did not reply would be deemed not to consent to receiving promotional notifications; and the matter did not involve the transfer or sale of members’ data. It said it had emailed members to clarify the “misunderstanding over the wording of the appendix.”
全港有逾百間分店、以人面識別作為唯一入場認證程序的連鎖健身室 24/7 Fitness (下稱 24/7）上月向會員發信，為已簽訂的合約增加附錄文件，保留該公司及「關聯人士」將會員的生物資料作統計或直銷用途的權利。有分店職員表示，即使會員沒有回覆電郵，亦會視作同意有關條款、若不同意則只能取消會籍；有會員在向私隱專員公署投訴後，方獲 24/7 回覆指生物識別資料將僅會用作會員進入場所之用。 前私隱專員、大律師黃繼兒表示，若公司使用個人資料的目的與收集資料時所聲明的不同，並在未另外徵得資料擁有人的明確同意下使用有關資料，便涉違規，又指「唔覆當同意係唔得」。 有會員向個人資料私隱專員公署投訴後，24/7 改口稱不會在未獲明確同意下，使用會員個人資料作直銷。私隱公署指就事件接獲兩宗投訴，上月底展開循規審查，兩度去信健身室待進一步回覆。記者上月底電郵向 24/7 查詢，截稿前一直未獲回覆。公司今午在《集誌社》社交媒體留言指，是按私隱公署指示向會員發合約附錄，會員不回覆會被視為不同意接收宣傳通知，不涉轉讓或出售會員資料，已電郵和會員澄清「附錄字眼上的誤解」。