Skip to content

Case Notes

Case Notes

This case related to Jurisdiction of Personal Data (Privacy) Ordinance

Case No.:2011A15

A company disclosed an employee’s personal data to security guards to prevent him from entering the company’s premises

(AAB Appeal No. 55 of 2011).

The Complaint

The Complainant was a driver who was diagnosed with depression and another illness. His employer (“the Company”) switched him to new duties which did not require his presence on the Company’s premises. There was a dispute as to whether the company had posted a notice on a window in the security room displaying his name, photo and staff identity number for the purpose of enabling the security guards to prevent the Complainant from entering the Company's premises.

Findings of the Commissioner

There was no evidence to suggest that the Company had disclosed the Complainant’s personal data to unrelated third parties, or had recorded gossip regarding the Complainant’s health. Since gossip is not personal data, it is not within the jurisdiction of the Ordinance. The Commissioner was not satisfied that there was evidence proving the Company’s breach of DPP3.

The Appeal

It was reasonable for the Complainant’s colleagues to learn that he had a mental illness due to his extended sick leave and attempted suicide. There was no evidence that the company had disclosed the Complainant’s personal data to unrelated third parties. However, upon hearing testimony of the two witnesses, the AAB was satisfied that there was a printed notice posted on the window of the security room prohibiting the Complainant from entering the Company’s premises and the notice was visible to outsiders. Given the notice contained the Complainant’s personal data, the Commissioner’s decision was considered flawed and a further enquiry was required.

The AAB's Decision

The appeal was allowed and the Commissioner was directed to reconsider the complaint.

uploaded on web in January 2014


Category : Provisions/DPPs/COPs/Guidelines : Topic/Subject Matter :