Case Notes

(AAB Appeal No. 21 of 2018)

Data access request – section 19 – compliance within 40 days – notified payment of initial processing fee on Day 39 – section 39(2)(ca) and paragraph 8(d) of Complaint Handling Policy – primary subject matter not relate to personal data privacy – paragraph 8(h) of Complaint Handling Policy – conciliation – cannot reasonably be expected to bring about a more satisfactory result

Coram:
Dr. LO Pui-yin (Presiding Chairman)
Mr. Ernest CHAN Ho-sing (Member)
Ms. MAK Yin-mei (Member)

Date of Decision : 18 March 2020

The Complaint

On 15 October 2016, the Appellant accompanied her mother to Tseung Kwan O Hospital for X-ray examination. Upon the request of the hospital staff, she assisted her mother to receive X-ray examination inside a room though somewhat unwillingly. She subsequently lodged her complaints with the Public Complaints Committee of the Hospital Authority and the hospital itself.

On 26 November 2017, the Appellant submitted a data access request to the hospital on her mother’s behalf to obtain 23 items of information relating to the incident. On 4 January 2018, the hospital notified the Appellant in writing that it could not comply with such request within 40 days after receipt, because she had failed to pay the preliminary processing fee of HK$76. In addition, the hospital claimed that it did not have enough time to sort out the requested information. However, the hospital would comply with her request as soon as possible and keep her notified.

The Appellant took the view that the hospital had failed to comply with her data access request within 40 days, and the reasons given therefor were insufficient and unreasonable. She therefore lodged her complaint with the Commissioner.

The Commissioner's Decision

After the Commissioner's intervention, for a number of times the hospital provided the Appellant (no matter directly or via the Commissioner) with a total of 100 odd pages of documents relating to her complaint, some of which did not contain her personal data. However, upon the Commissioner’s mediation, the hospital finally agreed to provide all the documents to the Appellant with the personal data of any third party redacted.

On 28 November 2018, the Commissioner informed the Appellant his decision not to investigate her complaint further on the following grounds:-

1. The hospital had not retained the relevant CCTV images. Given that the hospital’s use of CCTV surveillance was for general security purpose only and did not target at the Appellant, the Commissioner considered that such an act did not amount to collection of the Appellant’s personal data.
2. The hospital staff’s response to the Appellant’s allegations and explanation of the working procedures constituted his own personal data. The Appellant was not entitled to obtain a copy of such data or to correct it at all.
3. The Commissioner considered that the practice of the hospital was unsatisfactory, for example:-
   • The hospital should at least provide the Appellant with those documents it could locate within the 40-day period.
   • Shortly after receiving the data access request, the hospital should have already known that it was unable to provide the CCTV and telephone recordings to the Appellant. However, the hospital did not provide such explanation until Day 39, and blamed the Appellant for failing to pay the initial processing fee.
   • The hospital had delayed its response to the Appellant’s data access request until Day 53, due to its failure to pass such request to the medical records office as soon as possible.
4. Nonetheless, the hospital had already indicated to take measures to improve. The Commissioner had also sent out a letter urging the hospital to ensure that its staff would strictly observe the requirements in handling data access requests. At the same time, the Appellant had received all the requested documents. The Commissioner therefore took the view that the Appellant’s complaint had been satisfactorily resolved upon his mediation, and decided not to conduct further investigation in accordance with paragraph 8(h) of his Complaint Handling Policy.
5. In addition, the Commissioner considered that solely in dealing with investigation of the Appellant’s data access request would unlikely serve her purpose. The complaint mechanism of the Commissioner’s office should not be used as a tool for resolving disputes between the Appellant and the hospital, or for supplementing her right for discovery of documents in legal proceedings. The Commissioner therefore decided not to pursue the complaint further under section 39(2)(ca) of the Ordinance and paragraph 8 (d) of his Complaint Handling Policy.

Dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB did not affirm the Commissioner’s decision not to proceed with the complaint based on section 39(2)(ca) of the Ordinance and paragraph 8(d) of his Complaint Handling Policy. Evidence suggested that the hospital’s failure to comply with the Appellant’s data access request within the 40-day period represented the practice specified in her complaint. The primary subject matter concerned the hospital’s failure to notify the Appellant to pay the preliminary processing fee until Day 39 after receipt of her data access request, which also constituted one of the refusal grounds. Hence, the AAB took the view that there was no concrete ground in support of the Commissioner’s conclusion that the primary subject matter of the Appellant’s complaint was not related to her personal data privacy.

Nevertheless, the AAB endorsed the Commissioner’s decision not to pursue the complaint any further based on paragraph 8 (h) of his Complaint Handling Policy, i.e. given the conciliation by the Commissioner and remedial action taken by the party complained against or other practical circumstances, further investigation of the case could not reasonably be expected to bring about a more satisfactory result. The reasoning of the AAB were as follows:-

• The Commissioner did engage in mediation and as a result, the hospital agreed to provide the Appellant the requested documents with the personal data of any third party redacted.
• The Commissioner did criticize the practice of the hospital in handling data access requests. The hospital had already indicated to take measures to improve. The Commissioner had also sent out a letter urging the hospital to ensure its staff would strictly observe the requirements in handling data access requests.
• The AAB agreed that the hospital’s written notification given on 4 January 2018 itself did not contravene sections 19 (1) and (2) of the Ordinance. However, a data subject is entitled to have access to his personal data within a reasonable period of time under Data Protection Principle 6. Under such circumstances, the approach adopted by the hospital is indeed open to criticism.
• After considering the aforesaid and all the circumstances of the Appellant’s case, the AAB took the view that the Commissioner’s decision was lawfully and reasonably made in accordance with paragraph 8 (h) of his Complaint Handling Policy.

The AAB's Decision

The appeal was dismissed.

(Uploaded in July 2020)