(AAB Appeal No.17 of 2015)
Whether a charitable organisation was a ‘data user’ at the material time – No evidence that it was in control of the holding, processing or use of personal data being disclosed – Co-founder and director did not have the express, implied or ostensible authority of the organisation to disclose
Coram :
Mr. Alan Ng Man-sang (Presiding Chairman)
Mr. So Yiu-wing (Member)
Professor Cheung Siu-yin (Member)
Date of Decision : 17 October 2016
The Complaint
The Appellant was investigated and charged of a credit card fraud during the period from late 2010 to 2014. A charitable organisation helping migrant mothers and their children born in Hong Kong (“Organisation”) provided support to the Appellant.
According to the Organisation, it provided support to the Appellant during the following two periods :-
(a) 17 March 2011 to 16 June 2011
- in connection with a care or protection order obtained by the police for her son
(b) 9 April 2013 to 23 July 2013
- assistance limited to finding accommodation when she was evicted from her apartment due to non-payment of rent
Ms. X was the co-founder and director of the Organisation. She was the primary case worker of the Appellant’s case during her engagement of the Organisation’s service. Ms. X provided shelter for the Appellant, took care of her son and assisted her in seeking legal advice between March 2013 and April 2014. Ms. X obtained the Prosecution Bundle in the credit card fraud against the Appellant in March 2014.
In July 2014, the Appellant lodged an application against her parents in the High Court (Family Division) in London for her son to be returned to his habitual residence in Hong Kong under the Hague Convention on the Civil Aspects of International Child Abduction. The Appellant subsequently lodged her complaint with the Commissioner, alleging that Ms. X had disclosed the Prosecution Bundle and the Summary of Events to her parents without her consent, for the purpose of assisting the latter in defending her application.
The Commissioner’s Decision
The Commissioner had carefully considered the following circumstances leading to the alleged disclosure : -
(a) the Appellant’s parents were not clients of the Organisation;
(b) the Organisation ceased to have any relationship with the Appellant about a year ago before Ms. X sent an email to the Appellant’s father on 2 August 2014 with the Summary of Events attached thereto (“Email”);
(c) the Organisation did not collect or possess the Prosecution Bundle at any stage;
(d) the Summary of Events was prepared by Ms. X personally for assisting the Appellant’s parents in defending the child abduction proceedings commenced in London;
(e) Ms. X stated clearly in the Email that the Summary of Events and other attachments were provided to the Appellant’s father in her personal capacity and not in her capacity at the Organisation;
(f) the Email was sent out through Ms. X’s personal email account; and
(g) the Appellant acknowledged in her letter to the Commissioner on 3 March 2015 that Ms. X assisted the Appellant’s parents in her personal capacity.
The Commissioner was of the view that the Organisation was not a ‘data user’, as it was not in control of the collection and disclosure of the Complainant’s personal data contained in the Prosecution Bundle and the Summary of Events. Ms. X did so in her personal capacity and accordingly, the Organisation was not liable for the alleged disclosure made by Ms. X.
The Appeal
The AAB considered that there was prima facie evidence that the Organisation’s assistance to the Appellant extended beyond mere finding a new apartment to the realm of legal and psychological / psychiatric service.
However, the AAB agreed that the Organisation was not at the material time a ‘data user’. Although the Prosecution Bundle fell into the hands of Ms. X in March 2014 so that she could prepare the Summary of Events, this did not necessary mean that the Organisation could be said to be in control of the holding, processing or use of the Prosecution Bundle and the personal data contained therein solely because Ms. X was the co-founder and director of the Organisation. The AAB did not accept the Appellant’s submission that although Ms. X had withdrawn her support from the Appellant in April 2014 and the last time she had contact with Ms. X was in May 2014, her relationship with the Organisation nevertheless still persisted.
There was no evidence to the effect that Ms. X had the express, implied or ostensible authority of the Organisation to disclose the Prosecution Bundle and the Summary of Events to the Appellant’s parents. In particular, the disclosure was certainly against the interest of the Appellant and would run counter to the privacy policy of the Organisation.
The overwhelming evidence was that Ms. X made the disclosure in her personal capacity, and that Ms. X, the Appellant’s parents and even the Appellant knew about this at the material time. Hence, the Organisation was not liable to the Appellant for breach of DPP3.
The AAB’s Decision
The AAB dismissed the appeal.