2007.06.15 Unsolicited Electronic Messages Ordinance
Hong Kong, which has long been considered a spamming safe haven, has finally introduced legislation designed to control spamming activities originating from, and/or received in, Hong Kong. The Unsolicited Electronic Messages Ordinance, which was gazetted on Friday 1 June 2007, regulates the sending of unsolicited 'electronic messages' (including e-mail, fax, SMS, voice call and video messages) having a 'Hong Kong link' for the purpose of supplying, offering or promoting goods, services or opportunities for the furtherance of business ("Spam Messages").
A Hong Kong link will be established where the Spam Message originates from Hong Kong, i.e.:
- in the case of the sender being an individual, where the individual is physically present in Hong Kong at the time when the message was sent;
- in the case of the sender being an organization, where the organization is carrying on business in Hong Kong at the time when the message was sent;
- in the case of the sender being a company, where the company is registered in Hong Kong at the time when the message was sent;
and where the Spam Message is received in Hong Kong, which will be deemed in the following circumstances:
- where the telecommunications device used to access the message is located in Hong Kong at the time when the message is accessed; or
- where the registered user of the 'electronic address' (which includes an e-mail address, Internet protocol address, instant messaging account name, telephone and fax numbers) to which the message is sent is either an individual who is physically present in Hong Kong or an organisation that is carrying on business or activities in Hong Kong when the message is accessed.
Extra territorial application
In introducing extra-territorial application to the Ordinance, the Hong Kong legislature has conceded that there will be significant practical difficulties in enforcing its provisions on spammers operating from outside the jurisdiction. This is of particular relevance in Hong Kong where 99% of spam e-mail messages received by residents are generated from outside the jurisdiction. Extending the legal authority of the government and courts of any country beyond its national boundaries presents complex legal issues. In the case of anti-spam legislation, there will also be significant evidentiary challenges associated with enforcing national spam legislation against spammers located outside Hong Kong. To this end it is widely acknowledged in the international community that the prosecution of cross jurisdictional spamming activities will only be able to be effectively dealt with where there is co-operation between the relevant national agencies.
Notwithstanding the practical difficulties of enforcement, it has become increasingly commonplace for countries to assert some form of extra-territorial jurisdiction in important legislation when appropriate. Spam legislation has been no exception. The extra-territorial application of the Ordinance is important because it sends a message to the International community that Hong Kong is taking spamming seriously, while also providing Hong Kong with a framework for implementing international agreements and conventions on the subject and to facilitate cross-border enforcement at an operational level, including through information exchange and co-operation in investigations. The Ordinance expressly confers upon the Telecommunications Authority ("TA") the right to disclose information collected in Hong Kong relating to an investigation of a contravention of the Ordinance to overseas authorities pursuant to any international agreement entered into by Hong Kong.
There are currently no multilateral international agreements in place of a binding nature which deal specifically with the problem of spam. There is however a growing co-operation at the operational level between a wide range of anti-spam regulators around the world and a number of countries have entered into bilateral cooperation agreements. The Ordinance expressly gives the TA the ability to implement any such agreements or conventions to which the Hong Kong Government may decide to adhere.
Conditions and Offences
The Ordinance aims to control spamming in four ways. First, by ensuring that senders are readily identifiable and that the content of electronic messages is not misleading or deceptive. Secondly, by mandating and providing procedures for recipients of unsolicited electronic messages to opt out of receiving further messages. Thirdly, by proscribing 'unscrupulous' methods known to be employed by spammers in connection with sending unsolicited electronic messages to multiple recipients. Fourthly, by imposing harsh penalties on fraudulent activities commonly used in spamming activities.
- Conditions on sending Spam Messages
All Spam Messages having a 'Hong Kong link' must now accurately identify the sender of the message and contain information about how the sender can be contacted. Spam Messages must not have a subject heading which is likely to mislead the recipient about a material fact regarding the content or subject matter of the message, and must not contain any information which is not reasonably likely to remain valid for a period of 30 days.
Any person who sends a Spam Message in contravention of any of these conditions will be liable to receive, in the first instance, an enforcement notice from the TA specifying the steps required to be taken to remedy the contravention. The failure to comply with any such enforcement notice will, unless the sender can prove that it exercised all due diligence to comply with the enforcement notice, attract a fine of up to HK$100,000 on the first conviction and up to HK$500,000 on a second or subsequent conviction.
- Opt Out Procedures and 'Do-Not-Call' Registers
Spam Messages must also provide a functional unsubscribe facility through which the recipient can request to stop receiving further messages. The sender of any message in respect of which an unsubscribe request has been received must, within 10 days from the date of the unsubscribe request, cease sending any unsolicited messages and must additionally retain a record of the unsubscribe request for a period of at least 3 years. Account holders not wishing to receive any unsolicited Spam Messages will also be able to register their electronic addresses on 'do-not-call' registers to be set up by the TA. The sending of a Spam Message to any electronic address listed on a do-not-call register, which is required to be accessible by senders of Spam Messages, is also proscribed under the Ordinance.
Any person who sends a Spam Message without providing an opt out procedure, or who sends a Spam Message to any electronic address listed in a 'do-not-call' register, will also be liable to receive an enforcement notice and a fine for any contravention of such notice of up to HK$100,000 on the first conviction and up to HK$500,000 on a second or subsequent conviction.
- Prohibitions on using unscrupulous techniques to send Spam Messages
The Ordinance makes it an offence to supply or to use in Hong Kong software that is specifically designed to be used for collecting or compiling electronic addresses including from the Internet and public telecommunications directories, as well as to send messages to electronic addresses obtained using automated means (such as an automated process that generates possible electronic addresses, telephone numbers, fax numbers, etc by combining letters, characters, numbers of symbols into numerous permutations).
It is also an offence under the Ordinance to use an automated means to register more than 5 e-mail addresses for the purpose of sending multiple Spam Messages, or to use a telecommunications device or network to relay or retransmit multiple Spam Messages with the intent of deceiving or misleading recipients as to the identity of the sender.
The penalties for these offences range from HK$100,000 and/or 2 years jail for a summary conviction to HK$1,000,000 to 5 years imprisonment for a conviction upon indictment.
- Prohibitions on using fraudulent techniques to send Spam Messages
The Ordinance imposes a penalty of an unspecified fine and imprisonment for 10 years on conviction upon indictment for the following offences:
- accessing a telecommunications device, service or network without authorisation and knowing initiating the transmission of multiple Spam Messages from that device, service or network;
- imitating the transmission of multiple Spam Messages from telecommunications device, service or network without authorisation with an intent to deceive or mislead recipients as to the source of such messages;
- materially falsifying header information in multiple Spam Messages and knowingly initiating the transmission of such messages from a telecommunications device, service or network;
- registering, using information that materially falsifies the identity of the actual registrant, 5 or more electronic address or 2 or more domain names; and
- falsely representing to be the registrant or the legitimate successor of 5 or more electronic address or 2 or more domain names and knowingly initiating the transmission of multiple Spam Messages from any such electronic address or domain names.
Until a multilateral international agreement or convention is acceded to by members of the international community, or until Hong Kong enters into bilateral arrangements with the world's highest spam relaying countries (most notably the United States which is responsible for nearly 20% of the world's spam e-mails, but also, China, Poland, South Korea, Italy, France, Germany, Spain, Brazil, Russia and India), the Ordinance is unlikely to have much impact on spam e-mails received in Hong Kong as the authorities and courts will as a matter of practice only be able to enforce the Ordinance against Hong Kong based spammers responsible for only 1% of Hong Kong's e-mail spamming problem.
Where Hong Kong residents are likely to see an improvement is in terms of unsolicited faxes, SMS and voice messages which do generally emanate from within Hong Kong. Hong Kong residents will be able to register their telephone and fax numbers on Do-Not-Call registers by the end of this year and will be able to take action directly against entities who send Spam Messages via fax, SMS and voice mail to any number included on a register.
Conversely, any person or entity which engages in direct marketing in Hong Kong using e-mail, fax, SMS and/or voice messages will need to ensure that they comply with the conditions prescribed in the Ordinance and implement procedures to ensure that no unsolicited promotional messages are sent to fax and telephone numbers included on a Do-Not-Call register.
