Case Notes

(AAB Appeal No. 12 of 2021)

No cogent evidence indicating the company had disclosed any of the appellant’s personal data to her colleagues —remedial action taken — further investigation could not reasonably bring about a more satisfactory result— discretion not to further investigate the complaint duly exercised

Coram:
Ms Elaine LIU Yuk-ling, JP (Deputy Chairman )
Mr MAK Kwong-fai (Member)
Sr WU Kam-fai (Member)

Date of Decision: 24 March 2022

The Complaint

The Appellant learned that two of her colleagues had talked about her age and years of working experience during a conversation, which was recorded by a voice recorder placed by the Appellant at her workplace. In the recorded conversation, one of the colleagues claimed that he learned about the information from the deputy manager of the human resources department of the company. The Appellant alleged that the company, as an employer, had breached DPP3 and/or DPP4 of the Personal Data (Privacy) Ordinance (“PDPO”) by disclosing her age and years of work experience to other employee(s) without her consent and she therefore lodged a complaint to the Privacy Commissioner.

The Privacy Commissioner’s Decision

Upon the Privacy Commissioner’s preliminary enquiry, no evidence was found to substantiate the Appellant’s allegation that the company had disclosed her personal data to her colleagues. Given that the company had taken measures to enhance personal data privacy protection, the Privacy Commissioner exercised discretion under s. 39(2)(d) of the PDPO not to further investigate the matter. Dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Commissioner’s decision and dismissed the appeal on the following grounds:-

1. The Board considered that the conversation recorded in the voice recording was prima facie evidence. That said, such evidence should not be conclusive as there were two sides to the story. Having considered all the available evidence and explanations provided by the relevant parties, the Board agreed that there was no cogent evidence suggesting that the company had disclosed any of the appellant’s personal data to her colleague(s). In any event, the company had taken a series of remedial measures, including provision of training to its employees to enhance their awareness of personal data privacy, conducting internal meeting and review of its internal policies and guidelines to strengthen security of confidential information.
2. Even if the Privacy Commissioner continued to investigate into the complaint and found the Appellant’s complaint substantiated, no better result could have been achieved than what the company had already undertaken in terms of remedial actions. In such circumstances, AAB agreed that the Privacy Commissioner’s decision not to further investigate into the Appellant’s complaint was reasonable.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in March 2024)