Section 26 of the Personal Data (Privacy) Ordinance ("the Ordinance") only requires data user to erase personal data no longer required, it does not extend to impose an obligation to return the data to the data subject. The collection of personal data from third party does not necessarily render the collection by means that is unfair or unlawful when the third party has breached DPP3 in making the disclosure.
Complained about transfer of personal data from one government department ("the transferor department") to another ("the receiving department") in breach of DPP3 - No notification required to be given or consent obtained from data subject before collection from third party - the receiving department failed to return personal data no longer required to data subject - DPP1, DPP3, section 26
The Complaint
The facts of the case occurred more than 6 years ago concerning the transfer of a memo containing the complainant's personal data from the transferor department to the receiving department. In 2001 and 2004, the complainant had lodged complaints against the transferor department with the Privacy Commissioner, who subsequently refused to carry out or continue investigation. The complainant appealed against the decision in 2004 to the Administrative Appeals Board ("AAB"). AAB dismissed the appeal on the ground that the Privacy Commissioner was entitled to refuse investigation for a case happened more than 2 years ago but found that the data transfer without the complaint's consent was in breach of DPP3. As a result, the Privacy Commissioner issued a letter to the transferor department to remind it to adhere to the principles and provisions of the Ordinance when handling personal data.
In 2007, the complainant lodged complaints based on the same set of facts against the receiving department. He complained that his personal data were unfairly or unlawfully collected by the receiving department and then retained them. He alleged that the transferred data should have been erased or returned because of the AAB’s decision in 2004, and the subsequent use of the data by the receiving department in carrying out disciplinary action against him had also contravened DPP3. The transferor department was allegedly at fault also for failing to demand the return of the transferred data.
Findings by Privacy Commissioner
Based on the AAB's judgment in which the decision to refuse investigation was affirmed, the Privacy Commissioner found that it would be unfair to the concerned department to launch investigation against it on the same matter. It was opined that there was no unfair or unlawful collection of personal data on the part of the receiving department in the case. Nor was there any breach of DPP3 if the data were subsequently used by that receiving department in disciplinary proceeding and related actions because that was directly related to the purpose for which the data were collected. The Privacy Commissioner by virtue of section 39 refused to carry out an investigation.
The Appeal
The complainant argued, amongst others, that the transferring department should have demanded the return of the data, that the data collection of the receiving department was unfair as it was made without his consent, and that the retention of the data was in breach of section 26 as the data had not actually been used in the disciplinary proceeding.
The AAB ruled that the data collection was not unfair or unlawful. The receiving department in fact did not actively collect the data from the transferor department. Although the transferor department was in breach of DPP3 by so transferring the data, it did not make the data so received by the receiving department by means that was unfair or unlawful. The data collection was not made with the complainant’s consent, but DPP1 did not require such consent or notification to be given to the data subject when collecting data from third party.
The retention of the data was not in contravention of section 26 because the data was collected and retained in relation to the disciplinary actions taken by the receiving department against the complainant and the related legal proceedings were continuing.
There was no obligation for the data user to return the personal data held. Section 18 of the Ordinance only required data user to provide copy of the data. Section 26 required data user to erase the data when no longer necessary. It did not demand the return of the data in any event.
The AAB Decision
The Appeal was dismissed.