The complainant lodged 4 complaints against an organisation in their handling of his personal data. The Commissioner had decided not to pursue all of these complaints. The AAB dismissed all the appeals and awarded costs to the Commissioner in one of the cases on the ground that the appeal has been conducted in a vexatious and frivolous manner.
First Complaint Case (AAB Appeal No. 5 of 2011)
The complainant was a visually impaired person and joined certain activities provided by an organisation. The complainant claimed that he was not notified of the existence of surveillance camera installed by the organisation in the building (complaint A). The complainant also alleged being assaulted by the staff of the organisation. The incident was recorded and shown to a special committee convened to investigate the matter. The complainant complained against the committee members for viewing the recording without his consent (complaint B). The complainant also complained against the organisation for failing to obtain his consent for recording other activities participated by him (complaint C).
Findings of the Commissioner
Regarding complaint A, the Commissioner considered that the purpose for installation of the surveillance camera was not to collect the complainant’s personal data but for security purpose instead. In reliance of the Eastweek Case (Note), there was no issue concerning the data protection principles since there was no collection of personal data. Regarding complaint B, the Commissioner considered that there was no contravention of DPP 3. Regarding complaint C, the Commissioner noted that the complainant had signed a letter of agreement consenting to being recorded at the activities hosted by the organisation.
The Appeal
Regarding complaint A, AAB confirmed the Commissioner’s decision that there was no collection of personal data, hence it was unnecessary to carry out an investigation of the complaint. As an alternative ground, AAB also found that the organisation had taken remedial measures to notify the users of the building about installation of the surveillance cameras. No damage has been caused or will be caused to the users of the building, especially the complainant who had prior knowledge of such installation when he attended the premises on two occasions in December 2010 and January 2011. Regarding complaint B, AAB opined that the original purpose of the recordings was to record the actual events of the dispute. The complainant had verbally requested the organisation to view such recordings to investigate the matter. As the original purpose of collection and its subsequent use are directly related, prescribed consent of the complainant was not required. In any event, the complainant had given his prescribed consent. Regarding complaint C, since the organisation undertook to seek consent from individuals on every recording occasion in the future, the Commissioner was correct not to investigate any further.
The AAB's Decision
The Appeal was dismissed.
Second Complaint Case (AAB Appeal No. 44 of 2011)
The complainant complained against the organisation for late provision of the recordings in compliance with his data access request (complaint D). The complainant also complained against a staff member of the organisation for disclosing his medical note (complaint E).
Findings of the Commissioner
Regarding complaint D, there was a substantial delay in provision of such data by the organisation. The organisation explained this was due to the work involved in concealing the identity of other individuals captured in the recordings. The organisation undertook to engage professional assistance in the future to edit recordings of similar nature with the aim of complying with the statutory 40 days’ requirement. Regarding complaint E, the Commissioner was satisfied that the staff of the organisation did not disclose the complainant’s medical note. There was no breach of the requirements under the Ordinance, and the breach (if any) would be considered minute.
The Appeal
AAB ruled that the Commissioner was correct in refusing to investigate the two complaints. Concerning complaint D, AAB agreed that Part B, paragraph (g) and Part D of the Commissioner’s Complaint Handling Policy (“CHP”) applied, i.e. given the mediation by the PCPD, remedial action had been taken by the party complained against, an investigation of the case could not achieve a better result and issue of an enforcement notice would not be justified. Regarding complaint E, AAB decided that the following paragraphs (a), (d) and (g), Part B of the CHP applied:
(a) The act complained of is considered to be trivial, if the damage or inconvenience caused to the complainant is seen to be small;
(d) After preliminary enquiry by the PCPD, there is not prima facie evidence of any contravention of the requirements of the Ordinance;
(g) Given the mediation by the PCPD, remedial action has been taken by the party complained against, an investigation of the case cannot reasonably be expected to bring about a more satisfactory result.
The AAB's Decision
The Appeal was dismissed.
Third Complaint Case (AAB Appeal No. 45 of 2011)
The complainant complained against the organisation for failing to supply recordings of two meetings held on 9 and 15 December 2009 in compliance with his data access request (complaint F). He also complained against the organisation for merely providing the verbal transcript of another meeting held on 4 September 2009 rather than its live recordings (complaint G).
Findings of the Commissioner
With respect to complaint F, on the facts of the case the Commissioner was satisfied that there were no recordings of the two meetings held on 9 and 15 December 2009. Regarding complaint G, upon the Commissioner’s intervention, the organisation provided the live recordings of the meeting held on 4 September 2009 as requested.
The Appeal
Regarding complaint F, AAB ruled that there was no evidence of contravention of the requirements under the Ordinance. AAB also considered that since the complainant had himself kept sound recordings of the two meetings, there could not be any damage or inconvenience from such lack of access to the organisation’s recordings (if they existed at all). Regarding complaint G, AAB agreed that an investigation would not bring about a better result and it was pointless to issue an enforcement notice.
The AAB's Decision
The Appeal was dismissed.
Fourth Complaint Case (AAB Appeal No. 60 of 2011)
The complainant lodged complaints H and J which were identical to complaints B and E. The complainant also complained the organisation for collecting HK$20 from him for providing the CD which contained the recordings of the meeting (complaint I).
Findings of the Commissioner
Regarding complaint I, the Commissioner followed the Decision in AAB Appeal No. 37 of 2009 that the fees charged for data access request should be directly related and necessary to fulfill the request. Hence, the Commissioner decided that the fee of HK$20 satisfied such requirement and the amount was reasonable. Regarding complaints H and J, they were identical to complaints B and E which the Commissioner had decided not to investigate any further.
The Appeal
Regarding complaint I, AAB agreed that HK$20 was a reasonable amount. Regarding complaints H and J, AAB considered that both complaints were vexatious as the Commissioner had dealt with identical complaints already. AAB observed that there was no reasonable ground for making complaints H and J which were totally unmeritorious. In addition, having regard to the totality of the circumstances, and the manner of the complainant during the 4 appeal hearings in making numerous derogatory comments about the organisation and its staff, AAB concluded that complaints H and J were not made in good faith. It was decided that the Commissioner was correct in refusing to pursue the three complaints further.
The AAB's Decision
The Appeal was dismissed. AAB concluded that the appeal was conducted in a vexatious and frivolous manner and ordered the complainant to pay costs of the appeal pursuant to section 22(1) of the AAB Ordinance.
Note: Eastweek Publisher Limited & Another v Privacy Commissioner for Personal Data [2000] 2 HKLRD 83
uploaded on web in January 2014