A messenger of a law firm requested a receptionist to sign on a copy of a letter addressing to the complainant as acknowledgement of receipt thereby disclosing the complainant's personal data. The complainant lodged a complaint with the Privacy Commissioner alleging that the law firm had breached Data Protection Principle 4 ("DPP4") of the Ordinance.
Service of documents - acknowledgement of receipt by signing on copy letter addressing to the complainant - whether the law firm had breached DPP4 - remedial action taken by the law firm not to disclose the complainant's personal data to any other person other than the Complainant in the course of obtaining acknowledgement of delivery any document - Section 39(2)(d), 50(1)(a)(b) and DPP4 of the Ordinance
The Complaint
The Complainant specified a business center's address as her corresponding address. A messenger of a law firm delivered a letter to the Complainant at the business center's address by hand. The messenger passed a copy of the letter without any cover to the receptionist of the business centre and asked the said receptionist to sign on a copy of the letter as acknowledgment of receipt. The receptionist called the Complainant and read out part of the contents of the letter over phone to the Complainant. The Complainant complained to the Privacy Commissioner that the letter contained her personal data including reference to court actions involving the Complainant and should not have been disclosed by the law firm to the receptionist and the messenger.
Findings by Privacy Commissioner
The Privacy Commissioner made enquires with the receptionist who said that she did not know and could not recall anything in relation to the incident. During investigation, the law firm provided an undertaking to the Privacy Commissioner (i) not to disclose the Complainant's personal data to any person other than the Complainant when delivering any document to the Complainant by hand at the address for service including the business centre in the course of obtaining acknowledgement for service; and (ii) to give clear instructions to its staff for the purposes of complying with the undertaking.
Having considered the circumstances of the case, in particular, there was hardly any damage or harm done to the Complainant given the receptionist had no recollection of the alleged disclosure; and the remedial action taken by the law firm in giving the undertakings, any further investigation of the complaint would not reasonably be expected to bring about a better result, the Privacy Commissioner decided that, pursuant to section 39(2)(d) of the Ordinance, a full investigation of the complaint was unnecessary. Dissatisfied with the decision, the Complainant appealed to the AAB.
The Appeal
The issuance of enforcement notice under section 50(1)(a) and (b) of the Ordinance depends on whether there is, upon completion of a full investigation, a continuing contravention or a likelihood that a past contravention will continue or be repeated. The complaint involved a one-off incident. The alleged disclosure of personal data to the receptionist and the messenger would not be "a continuing contravention" by the time of completion of a full investigation (if made). Even assuming that the alleged disclosure to the receptionist and the messenger constituted a contravention of DPP4, by reason of the law firm's undertaking given to the Privacy Commissioner, there was no evidence of likelihood that the contravention would continue or be repeated. The remedy of the issuance of an enforcement notice had in fact been achieved through the undertaking given by the law firm to the Privacy Commissioner even without undergoing a full investigation. The AAB was of the view that the Privacy Commissioner was fully justified in concluding that any further investigation of the complaint would not reasonably be expected to bring about a better result in accordance with paragraph (g) of Part (B) of the Privacy Commissioner's Complaint Handling Policy. On this ground alone, the Privacy Commissioner could exercise his discretion to refuse further investigation under section 39(2)(d) of the Ordinance.
According to common sense, a messenger of a law firm is unlikely to be interested in the contents of the document which he was asked to deliver by hand. There was no suggestion or evidence that the messenger knew of the Complainant at all. In fact, the Complainant did not suggest that she suffered any loss, harm or inconvenience by reason of the alleged disclosure to the messenger.
As for the receptionist, the AAB was prepared to accept that personal data of the Complainant appearing in the letter were in fact disclosed to the receptionist. The Complainant claimed that the letter contained false information about her. Having considered another AAB prior decision under AAB No.49/2005 that "false statement or information" about a person does not constitute "personal data", the AAB was of the view that it could not be said that the Complainant suffered loss, harm or inconvenience by reason of disclosure of her "personal data". Whether the Complainant had a cause of action in tort of defamation was irrelevant.
The Complainant claimed that the receptionist was made aware of the reference to Court actions, being her personal data. The AAB accepted that the receptionist did not know and could not recall anything in relation to the incident. The disclosure of the letter to the receptionist was transient. There was no evidence to show that the receptionist kept any copy of the letter. Common sense dictated that it was not likely that the receptionist could remember details such as the action number of various civil actions mentioned in the letter. The AAB was of the view that the Complainant was unlikely to have suffered any loss, harm or inconvenience by reason of the disclosure of these court actions to the receptionist.
In the circumstances, the AAB was of the view that the Privacy Commissioner was fully justified in concluding that there could hardly be any damage or harm done to the Complainant by reason of the disclosure of the letter to the receptionist or the disclosure of the first page of the letter to the messenger. By reason of the triviality of the contravention, damage or harm, the Privacy Commissioner was entitled to exercise his discretion to refuse further investigation under section 39(2)(b) and 39(2)(d) of the Ordinance.
The AAB was of the view that based on the abovementioned two grounds, the Privacy Commissioner's decision was fully justified. It was thus not necessary to form any concluded view on whether or not the disclosure of the first page of the letter to the messenger constituted contravention of DPP4 on account of the messenger's role as an authorized agent of law firm. The decision of the AAB had been reached upon the assumption, in favour of the Complainant, that the disclosure of the first page of the letter to the messenger did constitute contravention of DPP4.
The AAB Decision
The appeal was dismissed.
uploaded on web in February 2010