Skip to content

Complaint Handling Policy

Complaint Handling Policy

Purpose

  1. The purpose of this Complaint Handling Policy is:
   
  1. to enable a complainant to understand the principles adopted by the Office of the Privacy Commissioner for Personal Data ("PCPD") in handling complaints, investigations and legal assistance applications;
  2. to enable a complainant to understand what specific criteria have to be met in making a complaint under section 37 of the Personal Data (Privacy) Ordinance ("the Ordinance");
  3. to bring to the awareness of the relevant parties to a complaint the standard policy of the PCPD in handling a complaint, to enable them to have a basic understanding and realistic expectation of how their case is to be handled; and
  4. in the event of any subsequent appeal to the Administrative Appeals Board, to enable the Board to give regard to such policy in accordance with section 21(2) of the Administrative Appeals Board Ordinance.
     
  2. This Complaint Handling Policy aims at providing a fair, consistent and efficient approach in the PCPD's handling of complaints under section 37 of the Ordinance. In particular, it covers the ways in which the Privacy Commissioner for Personal Data ("the Commissioner") usually exercises his powers and discretion under Part VII of the Ordinance, including but not limited to the following:
   
  1. acceptance of a complaint under section 37;
  2. discretion under section 39(2) to refuse to carry out or decide to terminate an investigation;
  3. exercising the general powers of investigation under Part VII;
  4. issuing an enforcement notice under section 50;
  5. notifying parties to a complaint the right of appeal against the Commissioner's decision.
  6. acceptance of legal assistance applications under section 66B; and
  7. the principles underlying the PCPD's handling of complaints, investigations and legal assistance applications.
   

The Policy

(A) Acceptance of a complaint under section 37
     
  3. The term "complaint" is defined in the Ordinance as "a complaint under section 37". In summary, a complaint under section 37 must satisfy the following criteria:
   
  1. it is in respect of an act or practice of a data user specified in the complaint, which relates to personal data;
  2. the complaint is brought by the individual who is the subject of the data, or by someone else in the capacity of a relevant person of such individual, as defined in the Ordinance; and
  3. the act or practice may be a contravention of a requirement under the Ordinance.
     
  4. In practice, the following information has to be provided to the PCPD in making a complaint under section 37:
   
  1. the complainant should provide his/her name and correspondence address for contact. Under section 39(1), the Commissioner may refuse to carry out or decide to terminate an investigation initiated by a complaint if the complaint is made anonymously or the complainant cannot be identified or traced;
  2. the complainant should provide his/her proof of identity by either producing his/her identification document (such as Hong Kong Identity Card) in person, or by sending copy of the document to the PCPD for verification. In the case where a complaint is lodged by a relevant person as defined under the Ordinance, supporting document or written authorization (as the case may be) has to be produced for verification of their identities and/or authorization;
  3. the complainant must specify the identity of the party complained against by providing his name and contact details. Mere provision of the means to trace the identity of party complained against e.g. a website or telephone number without other information to identify the individual is generally not considered as sufficient; and
  4. the complainant should produce sufficient information (including witness in some cases) in support of his/her allegation. Mere speculation is insufficient to substantiate a complaint e.g. the mere possession of personal data does not mean that the personal data is collected by unfair means.
     
  5. The PCPD will provide appropriate assistance to an individual to formulate his/her complaint and seek further information where necessary. Once the criteria for a complaint under section 37 are met, the PCPD will notify the complainant in writing of the acceptance of his/her complaint and specify the date on which the PCPD has received sufficient information from the complainant for satisfying those criteria. Where the criteria for a complaint under section 37 are not satisfied, no investigation will be carried out and the individual will be informed accordingly.
     
  6. However, where the Commissioner has reasonable grounds to believe that there may have been contravention of a requirement under the Ordinance, which involves personal data other than that of the complainant, he may conduct a compliance check against the data user's practice concerned and/or commence an investigation into the matter on his own initiative under paragraphs (b) and (ii) of section 38.
     
  7. In any event, the complainant is encouraged first to raise the matter complained of with the party complained against, as they may be able to resolve the dispute without intervention by the PCPD.
   
(B) Discretion under section 39(2) to refuse to carry out or decide to terminate an investigation
     
  8. Section 39(1) and (2) of the Ordinance contain various grounds on which the Commissioner may exercise his discretion to refuse to carry out or decide to terminate an investigation. In applying some of those grounds, the PCPD's policy is as follows:
   
  1. the act or practice specified in a complaint may be considered to be trivial, if the damage (if any) or inconvenience caused to the complainant by such act or practice is seen to be small;
  2. the complaint may be considered to be vexatious, if the complainant has habitually and persistently made to the PCPD other complaints against the same or different parties, unless there is seen to be reasonable grounds for making all or most of those complaints;
  3. the complaint may be considered not to be made in good faith, if the complaint is seen to be motivated by personal feud or other factors not related to concern for one's privacy, or the complainant furnishes misleading or false evidence;
  4. the primary subject matter of the complaint is considered not to be related to personal data privacy, e.g. the complaint stems essentially from consumer, employment or contractual disputes.

    In addition, an investigation or further investigation may be considered unnecessary if:
  5. after preliminary enquiry by the PCPD, there is no prima facie evidence of any contravention of the requirements under the Ordinance;
  6. the data protection principles are seen not to be engaged at all, in that there has been no collection of personal data. In this connection it is important to note that, according to case law, there is no collection of personal data by a party unless that party is thereby compiling information about an identified person or about a person whom it seeks or intends to identify;
  7. the complainant and party complained against are able or should be able to resolve the dispute between them without intervention by the PCPD;
  8. given the conciliation by the PCPD, remedial action taken by the party complained against or other practical circumstances, the investigation or further investigation of the case cannot reasonably be expected to bring about a more satisfactory result;
  9. the complaint in question or a directly related dispute is currently or soon to be under investigation by another regulatory or law enforcing body; or
  10. The ulterior motive of the complaint in question is not concerned with privacy and data protection.
     
  9. If any of the above grounds a) to j) is satisfied, the Commissioner may, having regard to all the circumstances of the case, exercise his discretion under section 39(2) to refuse to carry out or decide to terminate an investigation. The Commissioner shall notify the complainant in writing of his refusal to carry out an investigation and the reasons for the refusal within 45 days after receiving the complaint. For the avoidance of doubt, in calculating the 45-day period, time will only start to run from the date on which the PCPD has received from the complainant sufficient information to satisfy the criteria of a complaint under section 37, being the date specified in the PCPD's notification to the complainant of acceptance of his/her complaint. If the Commissioner decides to terminate an investigation before its completion, the Commissioner must, as soon as practicable by notice in writing served on the complainant, inform the complainant of the decision and the reasons therefor.
   
(C) Exercising general powers of investigation under Part VII
     
  10. Before the Commissioner invokes his general powers of investigation under Part VII, preliminary enquiries are normally carried out, which may include conciliation, to see whether the case can be resolved without a formal investigation. After an investigation has commenced, the powers available to the Commissioner under the various provisions of Part VII include mainly the following:
   
  1. power under section 43(1)(a) to be furnished with any information, document or thing, from such persons, and to make such inquiries, as he may see fit;
  2. power under section 44 to summon before him any person and to examine such person; and
  3. power under section 43(2) to conduct a hearing.
     
  11. Under section 43(1)(b), the Commissioner may regulate his procedure in such manner as he thinks fit. It is a matter for the discretion of the Commissioner which power or powers under Part VII he may decide to exercise in furtherance of an investigation. Generally speaking, under section 50B, any person who, without lawful excuse hinders or fails to provide information to the Commissioner in performing his functions, commits an offence.
     
  12. Under section 46(1), the Commissioner and other staff of the PCPD are obliged to maintain secrecy in respect of any information obtained in an investigation. Therefore, while parties will be informed of the general progress and outcome of their case, the PCPD may not be able to accede to a request for specific information (e.g. for a copy of a letter sent to the PCPD by another party) unless consent is obtained from the relevant party.
   
(D) Issuing an enforcement notice under section 50
     
  13. As the result of an investigation, if the Commissioner is of the opinion that the relevant data user is contravening or has contravened a requirement under the Ordinance, the Commissioner will have the discretionary power to serve on the data user an enforcement notice under section 50(1) directing the relevant data user to take such steps (including ceasing any act or practice) and/or measures to remedy and if appropriate, prevent any recurrence of the contravention.
     
  14. Under section 50(2), in deciding whether to serve an enforcement notice in the circumstances, the Commissioner shall consider whether the contravention to which the notice relates has caused or is likely to cause damage or distress to the relevant data subject.
   
(E) Appeal against the decision of the Commissioner
     
  15. The complainant may appeal to the Administrative Appeals Board against a decision of the Commissioner not to carry out an investigation of his complaint or, if there is an investigation, to terminate the investigation or not to issue an enforcement notice against the relevant data user after completion of the investigation, in accordance with sections 39(4) and 47(4) of the Ordinance respectively. As required by section 9 of the Administrative Appeals Board Ordinance, the notice of appeal has to be lodged with the Secretary to the Board within 28 days after receiving notice of the Commissioner's decision. On the other hand, where an enforcement notice has been issued by the Commissioner against a data user, the relevant data user may pursuant to section 50(7) of the Ordinance appeal to the Board against the Commissioner's decision of serving an enforcement notice not later than 14 days after the notice was served.
     
  16. According to sections 21(1)(k) and 22 of the Administrative Appeals Board Ordinance, for the purposes of an appeal, the Board may make an award as to costs against an appellant, if it is satisfied that he has conducted his case in a frivolous or vexatious manner, or against any other party to the appeal, if it is satisfied that in all the circumstances of the case it would be unjust and inequitable not to do so. Further enquiries about appeals may be made by writing to the Secretary to the Board at Room 321, 3/F, East Wing, Central Government Offices, 2 Tim Mei Avenue, Tamar, Hong Kong or by calling 2810 2831 / 3655 4092.
   
(F) Complaints lodged regarding suspected “doxxing” offence under section 64
     
  17. For complaints lodged regarding a suspected “doxxing” offence under section 64 of the Ordinance, the PCPD will conduct preliminary review of the cases. If the cases involved any suspected commission of an indictable offence under section 64(3C) of the Ordinance, they will be referred to the Police for follow up and the Secretary for Justice for consideration of prosecution. For other cases which may involve any suspected commission of an offence under sections 64(1) or 64(3A) of the Ordinance, the Commissioner may conduct a "specified investigation" as defined by Section 66C of the Ordinance. The Commissioner may institute summary prosecution of these cases in the Commissioner’s own name. After completion of the specified investigation, the Commissioner will inform the complainant of the result of the investigation.
   
(G) Legal assistance for civil claims under section 66B
     
  18. Section 66 of the Ordinance provides that an individual who suffers damage by reason of a contravention of a requirement under the Ordinance by a data user may be entitled to compensation from that data user for that damage. The Commissioner may, pursuant to section 66B of the Ordinance, grant legal assistance to the aggrieved individual who intends to institute proceedings to seek compensation. To ensure there is sufficient material on which to assess the merits of a potential claim (i.e. whether the applicant has a reasonable claim and prospect of success), an application for legal assistance would be considered after the PCPD has formed a view or made a decision on the complaint. For details, please refer to the leaflet entitled "Legal Assistance for Civil Claims under the Personal Data (Privacy) Ordinance" issued by the PCPD.
   
(H) Principles underlying the PCPD's handling of complaints, investigations and legal assistance applications
     
  19. The PCPD as a publicly-funded and independent statutory body has an obligation to use resources efficiently, effectively and fairly. On this basis, the following principles for the handling of complaints, investigations and legal assistance applications are formulated:
   
  1. ensure equity and fairness in the allocation of resources across all complaints and legal assistance applications;
  2. improve efficiency in the use of resources by reducing what can be a massive drain on the limited complaint and legal assistance application handling resources of the PCPD;
  3. ensure that the substance of the complaint or legal assistance application dictates the level of resources allocated to it, not necessarily the complainant's or legal assistance applicant's wishes, demands or behaviour;
  4. uphold the independent status of the PCPD bestowed upon it by the Ordinance by acting impartially, without fear or favour;
  5. ensure that the PCPD, not the complainant or legal assistance applicant, exercise ownership and control over the handling of complaints or legal assistance applications and reaching an outcome that the PCPD considers reasonable in the circumstances, whether or not the complainant or legal assistance applicant agrees; and
  6. comply with duty of care obligations of the PCPD as the employer.
   
The above Policy is for reference only. The PCPD reserves the right to change its Policy from time to time without notification to any parties concerned as circumstances may demand. For ease of reading, some of the provisions of the Ordinance have been summarised or paraphrased in this Complaint Handling Policy. For the precise wording of those provisions, please refer to the Ordinance.
   
© Office of the Privacy Commissioner for Personal Data
October 2021 (Seventh Revision)
   
If you want to lodge a complaint with the PCPD, please click here to learn more about the Complaint Procedures. For enquiries, please call the PCPD hotline at 2827 2827.