Q: We are a government department providing public service to minors. We are going to obtain the prescribed consent of "the relevant person" of a minor for using the latter's personal data for a purpose other than the purpose for which the data were to be used when collected. Whether such use of personal data contravenes the Personal Data (Privacy) Ordinance (the "Ordinance")?
A: The use of personal data is governed by Data Protection Principle ("DPP") 3 in Schedule 1 to the Ordinance. DPP3 stipulates that personal data shall not, without the prescribed consent of the data subject, be used (including disclosed and transferred) for any purpose other than the purpose for which the data were to be used when collected or a directly related purpose of collection, unless any applicable exemptions under Part VIII of the Ordinance apply.
Therefore, if any use of personal data by a data user is not for the original purpose for which they were collected or a "directly related" purpose. it is essential for the data user to obtain the prescribed consent of the data subject concerned. According to section 2(3) of the Ordinance, the "prescribed consent" of a person means the express consent of the person given voluntarily; and does not include any consent which has been withdrawn by notice in writing served on the person to whom the consent has been given.
Under section 2(1) of the Ordinance, "relevant person", in relation to an individual (howsoever the individual is described), means-
(a) where the individual is a minor, a person who has parental responsibility for the minor;
(b) where the individual is incapable of managing his own affairs, a person who has been appointed by a court to manage those affairs;
(c) in any other case, a person authorized in writing by the individual to make a data access request, a data correction request, or both such requests, on behalf of the individual.
However, there is no specific provision in the Ordinance to enable a "relevant person" to give "prescribed consent" on behalf of a minor. The "prescribed consent" under DPP3 has to come from the data subject.
uploaded on web in February 2010