Collection of library users' personal data on prescribed forms - library staff unable to furnish privacy policy statement upon request - alleged lack of rules and regulations relating to personal data policies and practices - the Privacy Commissioner's failure to notify the complainant of decision not to investigate within 45 days - DPP1(3), DPP5 and section 39(3).
The Complaint
The complainant complained that a library collected his personal data when he applied for facilities including reservation of Internet access and CD-ROM search services, request for printed materials or microfilm and application for electricity supply for a portable computer. Prescribed forms were required to be completed when such facilities were applied for. The complainant alleged that the library did not treat his data as personal data and suspected that there were no rules and regulations in place because staff were unable to provide him with any privacy policy statement upon request.
Findings of the Privacy Commissioner
The Privacy Commissioner found that personal data were collected on prescribed forms which contained a personal information collection statement ("the PICS") setting out the purposes of collection. In addition, a notice embodying the PICS was posted inside the library on a public notice board. A Privacy Policy Statement ("the PPS") was also found on the website of the administrator of library services. The Privacy Commissioner was satisfied that reasonably practicable steps had been taken by the library to comply with the requirements under DPP1(3) and DPP5 of the Ordinance. Dissatisfied with the Privacy Commissioner's decision not to investigate, the complainant appealed to the AAB.
The Appeal
In the appeal the complainant raised additional grounds for appeal on alleged excessive retention of his personal data by the library and the use of his personal data for statistical purposes without his consent. He also appealed against the Privacy Commissioner's failure to observe the mandatory requirement laid down in section 39(3) in notifying him of the decision not to investigate within 45 days of receiving his complaint, thus rendering the decision void.
The AAB agreed with the Privacy Commissioner's findings that all reasonably practicable steps had been taken by the library in that they had issued a PICS and PPS in compliance with the requirements of DPP1(3) and DPP5. As for the alleged excessive retention of personal data by the library and the use of his personal data for statistical purposes, the Board found insufficient evidence to support the allegations. Even if a prima facie case of contravention were established in one of the forms used by the library, the matter was never the subject of complaint before the Privacy Commissioner. As such, the matter had no bearing upon the Privacy Commissioner's refusal to investigate. Consequently the Board could not say that the decision taken by the Privacy Commissioner was wrong.
As for the statutory period of 45 days laid down in section 39(3), the Board found that nothing in the section indicated non-observance of the time limit would prevent a complainant from asserting his legal rights so that it would be in the public interest to render the Privacy Commissioner's decision void. The complainant's right to appeal to the AAB or his right to apply for judicial review of the decision was not affected by the decision being given after the 45-day period. The Board noted that the complainant did not provide proof of his identity to the Privacy Commissioner until the 45-day period had expired, making it impossible for the Privacy Commissioner to consider his complaint within the prescribed time. The Board went on to say that if the requirement under section 39(3) were mandatory, the Privacy Commissioner would be obliged to carry out an investigation despite the fact that the case might be one that the Privacy Commissioner might refuse to investigate under section 39(2). The Board asserted that this anomaly was not the intention of the legislature. In the Board's opinion, the intention of the legislature could not be that non-compliance would render the Privacy Commissioner's decision void.
The AAB's Decision
The AAB upheld the Privacy Commissioner's decision and dismissed the appeal.