(AAB Appeal No. 18 of 2015)
The Appellant complained against his employer for collecting and using his personal data obtained from the Judiciary’s website in taking disciplinary action against him. The AAB concluded that the employer’s collection of the Appellant’s personal data from the public domain was justified having regard to its obligations and that the subsequent use of the data was exempted under the Ordinance.
Coram :
Dr. Lo Pui-yin (Deputy Chairman)
Mr. Ng San-wa Lawrence (Member)
Mr. Seto Sai-wah (Member)
The Complaint
The Appellant was a civil servant working in a government department (“the Department”). He complained about the Department’s abusive collection of his information in a criminal case from the Daily Cause List of the Judiciary’s website and the judgment of the relevant appeal and its subsequent use of such information in its internal investigation and disciplinary action against him. The Appellant also complained that the Department had refused to provide him with information about the anonymous report which led to the Department’s said internal investigation against him.
The Comissioner's Decision
As the Appellant was bound by the Department’s policy to report criminal proceedings instituted against him, the Department’s access to the Daily Cause List was for the purpose of verifying the accuracy of any such criminal proceedings as alleged in the anonymous report and determining if disciplinary action should be taken against him. The subsequent downloading by the Department of the judgment of the Appellant’s appeal case was to monitor the development of the Appellant’s criminal case and to consider necessary action to be taken against him. Having regard to the aforesaid obligation of the Department, the Commissioner was of the view that the Department’s collection of the Appellant’s personal data contained in the Daily Cause List and the judgment did not contravene the Data Collection Principles of the Ordinance.
The Commissioner further decided that the Department’s subsequent use of the Appellant’s data in the Daily Cause List and the judgment in conducting disciplinary action against the Appellant was directly related to the original collection purpose of the personal data in question, i.e. for proceeding with actions against the Appellant in accordance with civil service guidelines and regulations. The Commissioner therefore considered that the Appellant’s complaint over the Department’s use of his personal data was unsubstantiated. The Commissioner considered that the Department was not obliged under the Ordinance to provide the anonymous report to the Appellant. The Appellant’s memo to the Department enquiring on how the latter learned about his criminal case and requesting for associated information or document did not constitute data access requests under the Ordinance. Lastly, it was noted that the Appellant had actual knowledge of the acts complained of for more than two years by the time the complaint was lodged. The Commissioner did not consider that the delay in lodging the complaint was justified and hence decided not to pursue the complaint further. Dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal with the AAB.The Appeal
The Appellant complained that (i) the Commissioner’s decision was inconsistent with his investigation report in the “Do No Evil” case (i.e. Report No.: R13-9744*) and (ii) the request for the anonymous report was a data access request under section 18 of the Ordinance.
The AAB ruled that the Commissioner was justified in refusing to pursue the Appellant’s complaint further on the ground of delay in lodging the complaint. The AAB was of the view that insofar as the Department’s access to the Daily Cause List was concerned, the Appellant had, at the time of lodging the complaint, actual knowledge of the Department’s access to the List for more than two years. Having considered the Appellant’s explanation for delay and arguments, the AAB found that the Appellant had failed to provide reasonable explanation for his delay, and the matters arising out of the Appellant’s complaint were not those that might have far-reaching implications beyond the immediate parties themselves or that would generally affect others who might be in similar situations.
With regard to the Department’s downloading of the judgment and its subsequent use of the same in taking disciplinary action against the Appellant, the AAB accepted the Commissioner’s argument and held that the exemption under section 58(2) of the Ordinance was applicable in that the data in question had been used for the remedying (including punishment) of seriously improper conduct by the Appellant. In particular, the AAB found that the Department had satisfied the "prejudice test” under section 58(2) as compliance with the requirement of seeking consent from the person sought to be disciplined (i.e. the Appellant) for the use of his personal data in the disciplinary action may impede or even undermine the effectiveness of the disciplinary action.
The AAB was of the view that the Commissioner’s findings in the “Do No Evil” case did not contradict or undermine the Commissioner’s decision not to pursue the Appellant’s complaint further. Unlike the present case in which the Daily Cause List and the downloaded judgment were used by the Department in taking disciplinary action against the Appellant, the “Do No Evil” case involved the collection and collation of personal data of numerous individuals from public registers by two companies for commercial exploitation without the knowledge of the individuals concerned. Applying the test set out in the “Do No Evil” case, the AAB was satisfied that a reasonable person in the Appellant’s situation (i.e. a civil servant bound by the relevant rules to report criminal proceedings instituted against him) would not find the re-use of the Daily Cause List and the judgment by the Department unexpected, inappropriate or otherwise objectionable, taking into account the sensitivity of the data and the context of the data collection.
The AAB also considered the Appellant’s memos to the Department not to have constituted data access requests under the Ordinance, as those memos contained no reference to the Ordinance, “personal data”, or “data access request”. The AAB considered that there was nothing in the language of the memos that suggested they were for the purpose(s) of ascertaining whether the Department held personal data relating to the Appellant and/or requesting for the supply of a copy of any such personal data relating to the Appellant ascertained as being held by the Department.
The AAB’s Decision
The appeal was dismissed.
* The investigation report can be downloaded from www.pcpd.org.hk/english/enforcement/commissioners_findings/investigation_reports/files/R13_9744_e.pdf
(Uploaded in August 2017)