AAB upheld the Privacy Commissioner's finding that the deleted data in documents supplied to the complainant in compliance with his data access request are not his personal data covered by such request, and thus proper for them to be edited out.
Data access request to ex-employer for copy of statement made by X against complainant - employer edited out data in copies of minute and memo supplied - proper deletion as data deleted not form part of the "copy of statement" requested for - sections 18 and 20 and DPP6
The Complaint
The complainant made a data access request pursuant to the PD(P)O to his former employer, a government department. In the request, he specifically asked for "a copy of the statement made by his former colleague, Mr. X, in relation to the complainant's letters of complaint no matter it is written by himself or recorded by another officer". There was no such entire document being a statement akin to a statement made by Mr. X. However, the department found two internal documents (one memo and one minute) reporting on matters arising from the complainant's various complaints with some information contained therein being provided by Mr. X about the complainant. The department therefore provided copies of these two documents only showing the information provided by Mr. X to the complainant. Later the complainant made another data access request to the Civil Service Bureau asking for the same data. When he compared both copies of documents, he discovered that his former employer had edited out some more information which did not contain third party's personal data and thus the complainant opined that these should not have been edited out.
Findings of the Privacy Commissioner
After reviewing the deleted parts of the documents and considering the wording of the subject data access request, the Privacy Commissioner was of the view that those deleted parts did not constitute the personal data as requested by the complainant in his data access request as these were not "part of the statement of Mr. X". As such, no contravention was found against the complainant's former employer. Dissatisfied with the decision, the complainant appealed to the AAB.
The Appeal
The bone of contention was over one of those deleted sentences, i.e. "As Mr. X did not have the contact telephone number of Mr. Y (being the complainant)..." which complainant opined should fall within the scope of the personal data that he asked for in his data access request.
At the hearing, the AAB ruled that as a matter of fact, the documents being internal documents were not within the scope of the appellant's data access request as the documents did not constitute the "statement" of the complainant's former colleague, Mr. X, that fits into the description of the data requested by the complainant. Further, AAB ruled that the deleted sentence did not contain any of the complainant’s personal data as the said sentence was given in the context of explaining why the complainant could not be reached for an appraisal interview.
AAB's decision
The appeal was dismissed.