The disclosure of a teacher's personal data (her divorce status) by the Headmistress of a kindergarten - disclosure without the teacher's consent - Headmistress apologized in her letter to the Privacy Commissioner - undertaking by the Headmistress to comply with DPP3 in future - discretion of the Commissioner under section 39(2)(d)
The Complaint
The complainant complained against the Headmistress of the kindergarten in which she was working as teacher for disclosure without consent of her personal data, namely her divorce status to her colleagues. The Headmistress admitted having disclosed the personal data to a substitute teacher at the time when the complainant requested for sick leave. The complainant did not agree that the disclosure was made to a substitute teacher but to other workmen of the kindergarten.
Findings of the Privacy Commissioner
The Privacy Commissioner conducted preliminary inquiry into the complaint. The Headmistress admitted disclosure to a substitute teacher. The complainant however insisted that the disclosure was made to other workmen of the kindergarten. No matter the identity of the third party to whom the disclosure was made, the Privacy Commissioner was of the view that DPP3 of the Ordinance was applicable to determine the legitimacy of the disclosure.
The Privacy Commissioner found that the personal data of the complainant had been collected by the Headmistress for human resources purposes related to her employment. The subsequent disclosure thereof, whether to a substitute teacher as alleged by the Headmistress or to other workmen as alleged by the complainant, was not directly related to the original collection purpose, hence not consistent with DPP3.
Being informed of such preliminary view, the Headmistress apologized to the complainant in her letter to the Privacy Commissioner and undertook not to further disclose the complainant’s personal data in the future. On the basis of the undertaking and of the view that further investigation would not yield to better result, the Privacy Commissioner refused to carry out further investigation pursuant to section 39(2)(d) of the Ordinance. Dissatisfied with the decision, the complainant appealed to the AAB.
The Appeal
The complainant abandoned her appeal at the hearing. The Board considered that the purpose of carrying out an investigation of the complainant's complaint was to find out whether the Headmistress had contravened the requirement of the Ordinance and if so, to consider taking appropriate measures to prevent repetition of the breach. The Commissioner's preliminary inquiry confirmed the Headmistress' contravention and she had undertaken to abide by the rules, hence the purpose of investigation completed. The purpose of the Ordinance was to reduce the possibility of infringement of privacy in order to protect personal data. The purpose of the Ordinance was not to punish the data user who infringed the Ordinance nor did the Ordinance confer such power of punishment to the Privacy Commissioner. Even if the complainant had suffered any damages as a result of disclosure of her divorce status, the Commissioner had no power to handle any such claim, or to require the Headmistress to apologize to anybody. However, the Headmistress did in her letter of undertaking expressed her apology and her willingness to apologize to the complainant in person. All these revealed that she would be careful in her future handling of staff personal data to avoid any contravention of the Ordinance.
The AAB agreed that the Privacy Commissioner had the discretion to refuse investigation under section 39(2) and the Board would not intervene as long as the decision was reasonable, legal and in accordance with prescribed procedures. The discretion of the Commissioner was found by the Board to have been reasonably exercised, the appeal should hence be dismissed.
The AAB's Decision
The complainant abandoned the appeal and the AAB found that the appeal should in any event be dismissed.