A law enforcement body completed investigation against a civil servant - allegations unsubstantiated - an investigation report sent to the government department for consideration of administrative or disciplinary action - sought access to the investigation report - access request refused under section 58(1) as advised by the law enforcement body - exemption was inseparable from the purpose for which the data was held - the department could not simply adopt the view of another data user and claimed the exemption
The Complaint
The complainant, a civil servant, was once under investigation by a law enforcement body. Upon completion of the investigation, a committee of the law enforcement body was presented with an investigation report ("the Report"). The committee then diverted the Report to the supervisor of the complainant together with a letter stating that the allegation against the complainant was not substantiated and that no further investigative action was warranted. After receiving the Report, the supervisor met the complainant and showed him the Report, but refused to give him a copy of it. The Report was then passed to staff of the management unit to consider if it was necessary to take administrative or disciplinary action against the complainant. The case was eventually closed without any such action being taken.
The complainant asked for a copy of the report from the Department for which he worked ("the Department"). The Department, claiming to have no reason to depart from the law enforcement body's objection to the disclosure, declined the request. The complainant then lodged a data access request ("the DAR") under section 18 of the Ordinance with the Department seeking access to the Report. Again, his request was turned down on the ground that the law enforcement body advised against the disclosure and that the Report was exempted from disclosure by virtue of section 58(1) of the Ordinance. The complainant then made a complaint to this Office.
Findings of the Privacy Commissioner
The Privacy Commissioner found that the Department had contravened section 19(1) of the Ordinance, for they had failed to put forward any grounds or justifications for claiming exemption to complying with the DAR. The Department, being different data user from the law enforcement body, could not simply follow the views of that law enforcement body and claimed exemption. As it was likely that the contravention would continue or to be repeated, an enforcement notice was issued against the Department demanding remedial steps to be taken. The Department lodged an appeal to the AAB.
The Appeal
The Department argued that they had established a case which justified refusal to comply with the DAR under section 58(1), and that it was wrong to hold that each government department was different data user and thus the exemption which might apply to the law enforcement body should have been equally applicable to them in respect of the same document.
The AAB stated that it was not right to say that once the personal data were held by a law enforcement agency for the prevention or detection of crime, the data subject could not have access to the same personal data held by the other institutions for innocuous purposes. Different persons might hold the same personal data at the same time for different purposes. Personal data such as personal identification might be held for prevention of crime or detection of crime by a law enforcement agency but at the same time held by a company for commercial purposes or by a hospital for medical purposes or other institutions for their particular purposes.
The AAB further stated that claim of the exemption under section 58(1) was linked to section 18(1) and DPP6. The data user had to show the purposes for which he held the data was one or more of the specified purposes and allowing the data subjects to have access to them would likely prejudice the purposes for which the data were being held. The exemption was inseparable from the purpose for which the data were being held. A data user was only entitled to claim exemption under section 58 if the purposes of that user in holding the personal data matched one of the grounds listed therein. That the law enforcement body might hold the Report for the purposes under that section did not entitle the Department to invoke the same exemption.
The AAB did not find any information that would indicate that compliance with the DAR would be likely to prejudice the investigation, prevention or detection of crime by the law enforcement agency or there would be a real and substantial risk that compliance with the DAR by the Department would have such prejudicial effect. The Department received the Report for information, and had studied it for administrative purposes. Their conclusion was that nothing in the Report was sensitive to the operation of the law enforcement body and there was nothing in the Report not known to the complainant.
The AAB did not see why the Department had to rely on the law enforcement body's objection to refuse the DAR made to themselves as a data user. If they relied on section 58(1) to decline the DAR, they should provide their own justifications for so doing and not the justifications of another data user who was not a party to the DAR. Where data held by a body for the purpose of prevention or detection of crime were released to another person for a different purpose, the latter did not hold the data for the same purpose as the former. In that case, the body responsible for prevention or detection of crime had to have regarded it safe to release the data, otherwise, they would not have done so in the first place, particularly when they did not retain control of the use of the data by the person to whom the data had been released. That being so, the AAB did not think that section 58 intended that access to the data held by the latter by the data subject should be denied on the ground that the release would be likely to prejudice the prevention or detection of crime, etc.
The AAB's Decision
The AAB upheld the Privacy Commissioner's decision and dismissed the appeal.