Requested copy of personal data for litigation purpose – DPP6
The Complaint
The complainant was an agent of an insurance company. The company had issued a warning letter to the complainant, mentioning that according to a video recording submitted by her supervisors, she had admitted several wrongdoings that had caused serious damage to the company. Shortly after the issuance of the warning letter, the company terminated the complainant’s service contract.
The complainant therefore submitted a data access request to the company, requesting a copy of her personal data contained in the video recording. The complainant also stated that her purpose of obtaining the video recording was to pursue her claim against the company for the wrongful and unlawful termination of her service contract and for all damage suffered.
The Company agreed to comply with the data access request in the form of a transcript. As the complainant stated that she would only accept a copy of the video recording in a video format, she made a complaint to this office.
Outcome
In the judicial review case of Wu Kit Ping v. Administrative Appeals Board HCAL 60/2007, the Judge held that the purpose of the Ordinance is to protect the privacy of an individual, and to enable an individual to check on and if necessary rectify, data held by a data user. In accordance with the court judgment, the data access right conferred upon a data subject under the Ordinance should not be abused nor should it be exercised to substitute or replace other proper channels for discovery of documents.
Besides, in the case of Administrative Appeal No. 10/2013, the Administrative Appeal Board agreed that the appellant was clearly attempting to gather evidence to substantiate his case against the data user by making the data access request in question, and the PCPD was fully justified and had rightly relied on section 39(2)(ca) of the Ordinance to not pursue the case further of which the primary subject matter of the complaint was not about personal data privacy.
This complaint obviously stemmed from an employment dispute between the complainant and the company. The PCPD was of the view that the complainant was using the mechanism of data access requests to supplement or as replacement for the rights of discovery in legal proceedings arising from an employment dispute between the company and her. In this regard, the PCPD considered that the provision of the transcript was sufficient for the compliance with the data access request under the Ordinance, and to manifest the complainant’s personal data privacy right.
Lesson learnt
The Ordinance provides an important right to members of the public to access their personal data, and the data user is obligated to handle data access requests in accordance with the Ordinance. However, individuals often misunderstand the right given to them under the Ordinance, and use it to supplement or as replacement for the rights of discovery in legal proceedings. In fact, the legislative intent of data access request is to provide a channel to a data subject to access his or her personal data held by a data user, and to request correction when an inaccuracy is noted. Individuals should not expect to obtain information for litigation purpose or resolve their disputes with the data user by using the mechanism of data access request.
(Uploaded in August 2020)