Employee complained about her employer's keeping of her personal records which the employee considered to be incorrect. Employer was not in breach of the Ordinance for not correcting the records because no data correction request was given to the employer.
Alleged incorrect employee's personal records - data correction request cannot be made verbally - No breach for failure to correct personal data in the absence of a data correction request - DPP2(1), section 22
The Complaint
The complainant is an employee of a government department ("the Department"). The complainant complained to the Department alleging that she had been receiving unfair treatment by her supervisor. Upon investigation, the Department found that the complaint was not substantiated by evidence.
The complainant subsequently made a data access request ("the DAR") to the Department for copy of all her personal records and the Department did comply with the DAR. After receiving the documents she requested in the DAR, the complainant complained to the Privacy Commissioner against the Department, in which she set out a list of 16 "incorrect facts" she found in the documents and her concern that the investigation carried out by the Department was incomplete and incorrect.
During the course of the Privacy Commissioner's enquiries, the Department, upon notice of the "incorrect facts", corrected 2 but refused to correct the other "incorrect facts" as they were not inaccurate.
Findings by Privacy Commissioner
The Privacy Commissioner found that, after the DAR was given to the Department, the complainant did not make any data correction request to the Department under section 22 of the Ordinance. Therefore, the Department could not have been in breach of failing to comply with a data correction request.
Moreover, the "incorrect facts" that the Department refused to correct were not the complainant's personal data, not inaccurate or were factual disputes only. The Privacy Commissioner considered that the complaint was essentially employment dispute and that there was no prima facie evidence that the Department had contravened the Ordinance. In the circumstances, the Privacy Commissioner decided that an investigation was unnecessary.
The complainant appealed against the Privacy Commissioner's decision.
The Appeal
The AAB took the view that the complaint was about (i) the alleged inaccuracy in her personal records and the Department's refusal to correct them; and (ii) the alleged improper investigation by the Department.
DPP2(1)(a) does not mean that personal data held by the data user must be correct in all respects. The mere fact that the data are found to be inaccurate does not constitute a contravention of the Ordinance provided the data user has taken all practicable steps to ensure their accuracy. The keeping of inaccurate personal data would become a contravention if, upon receiving a data correction request, the data user still refuses to correct them.
On the complainant's argument that she had made a data correction request verbally, the AAB considered that data correction request cannot be made verbally, otherwise, it would be difficult to verify whether such request was actually made and what the requested correction was.
In the absence of a data correction request, whether the data were inaccurate would be a dispute of fact which the Privacy Commissioner does not have the power to resolve, and there was no prima face evidence that the Department was in breach of the Ordinance. Moreover, it was not within the power of the Privacy Commissioner to reopen the investigation by the Department which the complainant considered to be improper.
The AAB decided that the Privacy Commissioner's decision not to investigate the complainant's complaint was correct.
The AAB Decision
The appeal was dismissed.
uploaded on web in October 2009