Susan received an invitation card by mail and by email from Wonderful Restaurant Limited (the "Company"), which owned several restaurants, to attend their food exhibition. The sale representative of the Company also made phone call to Susan to promote their buffet package. The Company obtained her full name, phone number, email address and residential address during their customer surveys through Internet. Susan was dissatisfied that the Company used her personal data without her consent and the invitation card did not contain any statement to inform Susan that she could "opt-out" the marketing materials.

John dined at the restaurant owned by the Company and had previously provided the Company with his name and phone number when making table reservation. Thereafter, John regularly received marketing phone calls from another restaurant (which John never dined before), which was owned by a sister company of the Company, promoting their buffet package. Despite his opt-out request, he still received marketing phone calls and John was dissatisfied the Company's sister company using his phone number for direct marketing without his consent.

REQUIRED:

Critically evaluate the legality of the above direct marketing activities of the Company and its sister company with reference to the Personal Data (Privacy) Ordinance and the Unsolicited Electronic Messages Ordinance. Make all necessary assumptions where necessary. (Note: Refer to relevant case law, where appropriate, to support the evaluation of the case)