Skip to content

Case Notes

Case Notes

This case related to DPP6 - Access to personal data

Case No.:2012A05

The Company refused to comply with the Appellant's DARs

(AAB Appeal No. 26 of 2013)

The Complaint

The Appellant attended a job interview with a company ("Company") and signed a written authorisation to authorise the Company to obtain personal references from her former employers. The Company subsequently obtained from Employers X and Y references regarding the Appellant.

The Appellant later made two DARs under section 18(1) of the Ordinance to the Company seeking her "personal reference return" and "all reference letters" regarding her from Employers X and Y respectively. The Company refused her DARs and therefore the Appellant lodged a complaint with the Commissioner against the Company.

Findings of the Commissioner

In response to the Commissioner's enquiries, the Company through its solicitors cited the exemption under section 56, arguing that issuing personal reference to an ex-employee by the witness of the reference letters is unlikely to be in the ordinary course of their respective occupation. The Company further confirmed that it possessed the Appellant's personal references issued by Employers X and Y ("X Reference" and "Y Reference" respectively), which were provided on the basis that they would be kept strictly confidential by the Company. Consent to the release of X Reference was finally obtained from Employer X. But Employer Y was not prepared to give such consent and reiterated that the assurance given by the Company to keep all information provided strictly confidential should be honored.

The Commissioner took the view that the Company's reliance on the exemption stipulated in section 56 was not justified in the circumstances because the reference was not given by an individual other than in the ordinary course of his occupation. The Commissioner, however, considered that Employer Y had controlled the use of Y reference in a way to prohibit the Company from complying with the Appellant's DAR. Accordingly, by virtue of section 20(3)(d), the Company was entitled to refuse to comply with the Appellant's DAR.

The Appeal

The AAB agreed with the Commissioner's view that the exemption under section 56 was not applicable to the Company. The person who gave the reference gave it in her capacity as the Assistant Manager of Employer Y. As such, the AAB could not find any interpretation other than she did so in the ordinary course of her occupation.

Regarding the Company's reliance on confidentiality to refuse to comply with the Appellant's DARs, the AAB opined that confidentiality is not a reason stipulated in the Ordinance to permit a data user to refuse to comply with a DAR. It is not a reason afforded to a data user who received the data upon an assurance of confidentiality, nor is it a reason afforded to a data user who supplied the data on the strength of such assurance.

The AAB took the view that Employer Y did not state its position whether it prohibited the Company from complying with the Appellant's DAR. If it did, then Employer Y would be deemed to hold the data under section 18(4). If it did not, then section 20(3)(d) could not apply to extricate the Company. Employer Y's stance was ambiguous and contradictory. The AAB considered that further investigation was required to ascertain, amongst others, whether Employer Y denied that section 18(4) was applicable to it and if so, the reason thereof.

The AAB's Decision

The AAB allowed the appeal, and reversed the Commissioner's decision as far as Y Reference was concerned. The AAB ordered that the case be sent back to the Commissioner to continue further investigation.

uploaded on web in February 2015


Category : Provisions/DPPs/COPs/Guidelines : Topic/Subject Matter :