Q: We engage in banking activities. We would like to know the definition of "subsequent collection" under S.35 of the Ordinance and whether the transactions of customer account will constitute "subsequent collection".
Secondly, we would like to seek your view as to the meaning of "material difference" under S.35(1)b(i) of the Ordinance. Please give us your opinion on whether the circumstance of subsequent collections mentioned below are materially different to the first collection.
(a) Our bank asks the existing account holder to supply us extra data.
(b) The existing account holder becomes a guarantor in another transaction and our bank asks him to give us his personal data again.
A:. In our view, all transactions in relation to a customer account which involve a collection of personal data would amount to subsequent collection for the purpose of section 35 of the Ordinance. Such transactions include, for example, the withdrawal of funds from an ATM machine that involves the recording of the commands entered into the ATM by the individual.
2. (a) The reference to "material difference" in section 35 of the Ordinance is basically a reference to the information required to be given to an individual pursuant to data protection principle ("DPP") 1(3) in Schedule 1 to the Ordinance. In particular, by virtue of DPP1(3) a data user that collects personal data from an individual who is the subject of that data is required to inform that individual explicitly of the following :
(i) the purpose for which the data are to be used;
(ii) the classes of person (if any) to whom the data may be transferred; and
(iii) the individual rights to request access to and correction of personal data of which they are the subject and to whom to make such requests.
As the above-mentioned information does not depend directly on the kind or amount of personal data collected, it is possible that "extra data" could be collected without there being a "material difference" in what the individual needs to be informed of pursuant to DPP1(3). However, whether this is so in a particular case depends on its particular facts. For example, if the "extra data" is collected for a purpose that the individual was not previously informed of, there would be a "material difference" for the purposes of section 35 of the Ordinance.
(b) Generally speaking, the purposes for using data collected from an individual who is acting as a guarantor will be different from the purposes for using data collected from an individual who has not previously acted as a guarantor or borrowed money as a principal from the institution concerned. For example, one of the purposes for using data in the former case is to collect any debt that the guarantor becomes liable for, which is not an applicable purpose in the latter case. This would be a "material difference" for the purpose of section 35 of the Ordinance.