The PDPO does not impose a duty on data user to retain personal data, it only prevents data user from retaining personal data unnecessarily.
Data access request ("DAR") made by a university student for examination script and external examiner's correspondence - university no longer held the examination scripts after 1 year - no evidence to the contrary found - external examiner's correspondence did not contain the Appellant's personal data - no contravention of section 19(1) - section 26, DPP2(2), DPP4
The Complaint
The complainant was a university student. She made a DAR to a university for copies of her examination script ("Script") and the related external examiner's correspondence ("the Correspondence") one year after the examination was sat. The university replied they were unable to comply with her DAR because (1) it was the normal policy of the university department in question to destroy examination scripts after 1 year; (2) the Script did not contain any personal data about her; and (3) the Correspondence merely contained comments on the examination arrangements and did not give specific comment on individual script. Dissatisfied with the reply, the complainant lodged a complaint with the Privacy Commissioner for the failure of the university to comply with her DAR.
Findings by the Privacy Commissioner
Generally speaking, an answer in an examination does not amount to personal data of the candidate unless the answer contains information about the candidate personally. There is no provision in the Ordinance that requires a data user to retain personal data. Having examined the university's code of practice and the Correspondence, the Privacy Commissioner accepted the university's code of practice did not impose any specific time limit for the retention of the mark sheets and examination scripts and there was no contrary evidence to show that the university did hold the Script at the time of receipt of the DAR. The Privacy Commissioner had also examined the Correspondence and agreed that it did not contain personal data of the Appellant. Since there was no prima facie evidence of contravention of section 19(1), the Privacy Commissioner refused to carry out an investigation of the complaint under section 39(2)(d). The complainant appealed against the Privacy Commissioner's decision.
The appeal
The Appellant contested that the Privacy Commissioner was wrong in accepting the university's explanation that the department's practice was to destroy examination scripts after 1 year and they no longer held the Script. She argued that the university had a duty to retain the Script in order to comply with DPP4 in protecting the personal data against "unauthorized or accidental access, processing, erasure or other use...". She also argued that the Script and the Correspondence contained her personal data. The Appellant, however, could not supply any fact or evidence to support her claims. The Administrative Appeals Board ("AAB") was satisfied that the Privacy Commissioner did not act unreasonably in accepting the university’s response that they did not hold the Script and that the Correspondence did not contain her personal data.
The AAB remarked that if an examination script of the complainant was marked with the examiner's comments or evaluation of the complainant's answers, these evaluation or comments could be personal data of the complainant. In the present case, the examination scripts contained only the materials written by the student because examiners were not allowed to write any remarks on the scripts. The Privacy Commissioner did not err in stating that her answers in the Script did not amount to personal data belonging to her.
In relation to the duty to retain personal data, AAB rejected the Appellant's arguments and ruled that neither did the provisions of the Ordinance impose any positive duty on a data user to keep or retain one's personal data until the purpose for which the data was originally collected is exhausted; nor did they require a data user to justify his or her deliberate decision of not continuing to retain one's personal data.
AAB's decision
The appeal was dismissed.