If you suspect that your privacy rights relating to personal data are being abused, you should first raise your concern with the party that you suspect of abusing your personal information before lodging a complaint. If you are dissatisfied with their response, you can lodge a complaint with the PCPD.
-
Who should complain-- An individual, or a "relevant person" on behalf of an individual, can make a complaint. If the individual is a minor, the "relevant person" is the individual's parent or legal guardian. If an individual cannot manage his or her own affairs, a "relevant person" is the person who has been appointed by a court to manage those affairs can make a complaint. Lastly, the individual may authorize in writing another person to make the complaint on his or her behalf and that person is a "relevant person".
-
How to make a complaint -- A complaint can be made in writing in Chinese or English, with your contact details and full particulars of your case. For convenience, this can be done by using the complaint form (general complaints (OPS001) / doxxing complaints (OPS004)) complaints obtainable from the PCPD. If you need help in making the complaint, you can visit the PCPD in person and our staff will assist you in completing the complaint form. All your dealings with the PCPD, and the information you provide will be handled in strict confidence.
-
The Commissioner's follow-up action -- After receiving a complaint and verifying the identity of the complainant, the Commissioner will first liaise with the complainant and the party complained against to determine whether a prima facie case can be established. If there is a prima facie case, the Commissioner will try to resolve the dispute through conciliation. If the dispute cannot be resolved through conciliation, the Commissioner may carry out a formal investigation. The Commissioner may also immediately proceed to undertake a formal investigation if the suspected contravention in the complaint case is of a serious nature. If the investigation confirms that the data user has contravened a requirement under the Ordinance, the Commissioner may serve an enforcement notice on the data user concerned to direct it to take necessary steps to remedy the contravention and/ or instigate prosecution action. Contravention of an enforcement notice is an offence which could result in a fine or imprisonment.
Remedies - Apart from criminal sanctions that can be imposed on a data user that has contravened the Ordinance, if an individual believes that he or she has suffered damage, including injury to feelings, as a result of a contravention of the Ordinance, he or she has the right to seek compensation from the data user concerned through civil proceedings. The Commissioner may, pursuant to section 66B of the Ordinance, grant legal assistance to the aggrieved individual who intends to institute proceedings to seek compensation.