Case Notes

Disclosure of personal data by posting letter of complaint in lobby of a building - failure to delete irrelevant data did not amount to breach of DPP3 - collection unnecessarily meant active collection - cessation of complained act before investigation - a more satisfactory result could not be reasonably expected - discretion under section 39(2)(d) - the Board would not intervene discretion exercised reasonably, legally and in accordance with prescribed procedures

The Complaint

The complainant, who was the landlord of a residential property, sent a letter to the Owners Incorporation of the building to complain against the water seepage problem caused to her flat because of the improper maintenance of common area. It was said in the letter that the Owners Incorporation should bear the costs of repairing her flat. Upon receiving the letter which contained the complainant's name, address and telephone number, the Owners Incorporation posted the letter in the lobby of the building. The complainant complained to the Commissioner’s Office that the Owners Incorporation failed to obliterate her data, in particular her telephone number, from the letter before posting it.

Findings of the Privacy Commissioner

The Privacy Commissioner came to the view that the purpose of posting the letter was directly related to the purpose of collecting the complainant's personal data hence, there was no breach of DPP3. Moreover, for the letter had been taken down subsequently by the Owners Incorporation, a more satisfactory result could not be reasonably expected from any further investigation. The Commissioner therefore refused to carry out an investigation pursuant to section 39(2)(d) of the Ordinance.

The Appeal

The complainant sought to argue amongst others, that:

1. the Owners Incorporation had no ground to publicize her telephone number;
2. DPP3 had no application in the situation, for the Owners Incorporation did not collect but was only given the letter containing her personal data; and
3. The Commissioner could not refuse investigation by stating that investigation could not bring a more satisfactory result, for her privacy had been intruded when the letter was posted in the lobby.

The Board ruled that the Owners Incorporation did collect the complainant's personal data by passively receiving her letter of complaint, for the meaning of "collection" did not necessarily mean active collection. The purpose of posting the letter was to inform all owners of the building, to give them opportunity to express opinion, and to make decision in respect of the water seepage complaint. It was noted that if the water seepage was as stated by the complainant, all owners of the building would have to bear the repair cost. Accordingly, the Board decided that the purpose of disclosure of the complaint letter was directly related to the original purpose of collection of the letter.

It was necessary to disclose the content of the letter together with the complainant's name and address. Otherwise, the owners would doubt the truthfulness of the complaint, thus causing difficulties to the Owners Incorporation in handling the problem. Although disclosure of telephone number was of no assistance to the purpose of posting the letter, DPP3 was not breached.

In accordance with section 39(2)(d), the Commissioner could base on whatever grounds to refuse investigation, provided that he exercised his discretion reasonably, legally and in accordance with prescribed procedures. In this circumstance, the Board would not intervene his decision. The Board agreed that in the circumstances of the appeal case, to carry out an investigation of the complainant's complaint has no practical effect since the purpose of requiring the Owners Incorporation to take down the letter had been fulfilled. The Board therefore decided that the Commissioner had reasonably exercised his discretion to refuse to carry out an investigation.

The AAB's Decision

Appeal dismissed.