In filing a complaint with the Privacy Commissioner under section 37(1) of the Ordinance, the act or practice complained of must relate to personal data of the individual who is the data subject.
Data access request made for copy of an invoice - the data requested did not satisfy the definition of "personal data" under section 2 of the Ordinance - the Privacy Commissioner refused to handle the "complaint" about non-compliance with data access request - matter not subject to appeal to the AAB - definition of "personal data", section 37(1), DPP6
The complaint
The complainant made a data access request to a public organization for copy of an "invoice". The organization informed the complainant that since he could not furnish adequate information for it to process the request, it could not provide the complainant with the requested data. The complainant complained to the Privacy Commissioner that the organization contravened the Ordinance because it did not comply with his data access request by supplying him with copy of the "invoice" requested for.
Findings by the Privacy Commissioner
After inquiry, the Privacy Commissioner found that the "invoice" was neither issued by the complainant nor addressed to the complainant and it did not contain any of his personal data. According to the complainant, the "invoice" contained "the data related to his losses". The Privacy Commissioner opined that as the "invoice" did not fall within the definition of "personal data" under section 2 of the Ordinance and hence the "complaint" was not a valid complaint under section 37(1)(b)(ii), which requires that the act or practice complained of must relate to personal data of the individual who is the data subject. The matter therefore fell outside the jurisdiction of the Privacy Commissioner as provided under the Ordinance. Dissatisfied with the decision of the Privacy Commissioner, the complainant lodged an appeal with the AAB.
The appeal
The Board confirmed that its jurisdiction to hear an appeal against the decisions made by the Commissioner was laid down under section 3 of the Administrative Appeals Board Ordinance, Cap 442 ("the AAB Ordinance") and confined to such decisions covered in item 29 of the Schedule to the AAB Ordinance. Hence, the Board ruled that an appeal against the decision by the Privacy Commissioner not to carry out an investigation on the ground that the complaint lodged by the complainant failed to satisfy the requirements of a complaint under section 37 of the Ordinance was not one that the AAB had jurisdiction to hear.
In arriving at its decision, the Board had considered that the data requested by the complainant did not satisfy the definition of "personal data" and hence agreed with the decision made by the Privacy Commissioner on the case.
AAB's decision
The appeal was dismissed.