EAQE Agency management and supervision question: names and phone numbers to an unrelated mortgage brokerage

Answer: C. Lotus must first tell clients in writing, including that the data is provided for gain, and must obtain their written consent

Answer: Lotus must give the written notice and information required by section 35J (including that the data is provided for gain) and obtain the clients' written consent under section 35K. Why not the others: - Oral consent confirmed within 14 days: That rule is for a data user's own use; providing data to another person for its direct marketing needs written consent. - The brokerage does the marketing: Division 3 of Part 6A applies precisely when data is provided to another person for that person's direct marketing; the exception for agents marketing on the data user's behalf does not apply. - Opt-out afterwards: Consent must be obtained before the data is provided. Rule: Providing personal data to a third party for its direct marketing requires prior written notice and written consent; if done for gain, breach is punishable by a fine of HK$1,000,000 and 5 years' imprisonment. Circular No. 13-05 (CR) also requires express, voluntary consent before passing data to mortgage or legal service providers. Source: Personal Data (Privacy) Ordinance (Cap. 486), sections 35I, 35J and 35K, elegislation.gov.hk; EAA Practice Circular No. 13-05 (CR), paras 9 and 10; as at Oct 2026