Q: We are a statutory body charged with providing certain programmes to the public. We are requested by a policy bureau to disclose data of the participants to the programme to a local university for conducting an evaluation and planning survey in relation to the programme. The personal data proposed to be disclosed include the contact telephone numbers and profiles of the participants. The question is whether the proposed disclosure is allowed by the Personal Data (Privacy) Ordinance ("the Ordinance").
A: Data Protection Principle ("DPP") 3 in Schedule 1 to the Ordinance provides that personal data may be used or transferred only for a purpose for which the data were to be used at the time they were collected or for a directly related purpose, except where the consent of the data subject has been obtained. However, exemption from DPP 3 may be available under section 62 of the Ordinance for data used for statistics or research purpose. In particular, where personal data are to be used only for the purpose of preparing statistics or carrying out research and the results will not be made available in a form which identifies the data subjects, the transfer of personal data for such purpose is exempt from the requirements of DPP3 pursuant to section 62 of the Ordinance.