Whether a tertiary institution’s lecturer could upload students’ names and academic results to the institution’s official website without their consent
The Enquiry
A tertiary student enquired whether a tertiary institution’s lecturer could upload students’ academic information to the institution’s official website for public viewing, without obtaining the students’ consent.
Our Response
The Ordinance is enacted to protect privacy in relation to personal data of a data subject. Generally speaking, if it is reasonably practicable for one to directly or indirectly ascertain the identity of a data subject from the disclosed information, such data may fall within the scope of “personal data” under the Ordinance. Under these circumstances, the tertiary institution concerned should observe the requirements under Data Protection Principle 3 of Schedule 1 to the Ordinance when using (including disclosing) personal data, which prohibits the use of personal data for any new purpose which is not or is unrelated to the original purpose when collecting the data, unless with the data subject’s prescribed consent.
(Uploaded in August 2024)