AAB ruled that a data user is not obliged to supply requestor of a data access request "Consolidated Document List" of the personal data held by the data user having regard to the ground of refusal laid down in section 20(3)(b) of the PDPO.
Two data access requests made by a staff of the University - section 18(1) of the PDPO - alleged contravention of section 19(1) of non compliance with her data access requests - enforcement notice issued for supply of "consolidated document list" - section 20(3)(b) gives data user ground to refuse compliance when it is not supplied with information reasonably required to locate the personal data - enforcement notice amended by AAB - section 18 and DPP6
The Complaint
A University's staff made to the University two data access requests. The first request was in relation to her personal data held by the Personnel Office and a Department of the University. The second request was for all data including data that came into the possession of the University since her first request. In response to her two requests, the University provided her with the requested data (totaling 550 pages of documents). The staff was not satisfied with what she obtained. She lodged complaint with the Privacy Commissioner alleging that the University had not provided her with all her personal data as requested in her data access requests.
Findings of the Privacy Commissioner
Having completed the investigation of the complaint, the Privacy Commissioner found that the University failed to provide a copy of certain documents, which being the complainant's personal data, should have been given to her in accordance with section 19(1) of the PD(P)O. To remedy the contravention, the Privacy Commissioner served an enforcement notice on the University directing it, amongst others, to:
(1) conduct a thorough search of complainant's personal data that were in the possession and control by the University; and
(2) compile and provide to the complainant a "Consolidated Document List".
The Appeal
The University appealed to the AAB on the ground that the University was not obliged to provide the complainant with a "Consolidated Document List" of her personal data held by the University for data access requests made under section 18.
The AAB decided that by imposing the requirement of conducting a "thorough search", the Commissioner in effect placed a higher burden on the data user than the statutory duty to exercise all due diligence as required under section 64(8) of the PD(P)O. As regards the "Consolidated Document List", the AAB held that the complainant had no right to such a list and the imposition of this requirement was contrary to section 20(3)(b) of the PD(P)O. It was for the data requestor to identify the data he or she required and not for the data user to prepare a full or consolidated list for the data requestor to pick and choose.
AAB's decision
For the reasons as aforesaid, the AAB decided to strike out the requirements of a "thorough search" and a "Consolidated Document List" and adopted an amended enforcement notice to replace the one issued by the Privacy Commissioner.