Hong Kong’s Privacy Commissioner for Personal Data (PCPD) has addressed whether a bank can send lucky draw promotional emails to customers who have previously opted out of direct marketing.
Strip out the specifics and the question is one every sender has heard in some costume. It’s not marketing, it’s a competition. It’s not a promotion, it’s a prize draw. Surely the opt-out doesn’t cover this. The regulator published the enquiry as Case 2026E05 in August 2026, and the answer is that it does.
A prize draw is still marketing
According to the PCPD, a lucky draw promotional email may constitute direct marketing if it is addressed to a specific person by name and involves offering or advertising goods, facilities or services. Dressing a promotion up as a competition does not take it outside the regime.
Where that test is met, the organisation must comply with Hong Kong’s direct marketing requirements under the Personal Data (Privacy) Ordinance, including the relevant consent provisions. The PCPD’s guidance on direct marketing sets out those requirements in full.
Opt-out means opt-out
The PCPD also restated a point senders sometimes forget. Customers can require an organisation to stop using their personal data for direct marketing at any time. It makes no difference that they previously gave consent. Once an opt-out request has been received, the organisation must stop using that individual’s personal data for direct marketing.
There is no carve-out for campaigns the sender considers harmless, and no reset when the creative changes from a product pitch to a prize draw.
The DPP3 backstop
The regulator added a further layer, even where a lucky draw promotion does not qualify as direct marketing, the use of personal data must still comply with Data Protection Principle 3. DPP3 restricts the use of personal data for a new or unrelated purpose without the prescribed consent.
In practice this means a sender cannot escape scrutiny simply by arguing that a given message falls outside the direct marketing definition. The purpose limitation principle still applies to how the customer data is used.
What this is, and is not
This is an enquiry case, not an announced enforcement action. The bank is not named and no fine was reported. Breaches of Hong Kong’s direct marketing provisions can be prosecuted as a criminal offence, which is worth keeping in mind for any sender who finds themselves tempted to test the boundary the PCPD has just described.
