The Complaint
1. Summary of Facts
An ex-employee of a statutory body (the "organization") made a data access request (the "DAR") to the organization for a copy of his personal data relating to his employment. Since the requestor did not receive any response from the organization several months after he submitted his DAR, he contacted a staff of the organization. Though the staff clearly confirmed to the requestor that the requested data were ready for dispatch, the requestor was subsequently informed that all of the requested data were already destroyed.
2. Issue of the case
Non-compliance with data access request.
Outcome
1. Reasoning
During the enquiry stage of this complaint, the organization insisted that the requested data were already destroyed. However, the organization was unable to provide any substantial evidence to support its version. After the PCPD had carried out an investigation, the organization suddenly claimed to have discovered the requested data but gave varying reasons to justify its failure to comply with the DAR at different times.
Section 19(1) of the Ordinance requires the data user to comply with such request not later than 40 days after receiving the request.
Having regard to the circumstances of the case, in particular of the development of the case and the trustworthiness of the statements provided by the organization’s staff concerned, the PCPD had reasonable grounds to believe that the organization might in fact withhold the requested data at all material time when they received the DAR. Though the organization subsequently provided the requestor with a copy of the requested data, the PCPD ruled that the organization had contravened section 19(1) of the Ordinance as the requested data were supplied to the requestor far beyond the 40 days' statutory requirement.
2. Action by the PCPD
Since the organization subsequently provided the requested data to the requestor, serving an enforcement notice under section 50 of the Ordinance under the circumstances of the case is unnecessary. Nevertheless, the organization was seriously warned and reminded to comply with the relevant requirements of the Ordinance when handling data access requests in future.
uploaded on web in July 2009