Data access request – Requested data included data storing in paper file and computer system
The Complaint
The complainant was an applicant of an assistance scheme provided by an institution. He lodged a data access request with the institution for his personal data contained in the handling records of his application.
Given that the institution had only provided the complainant with a copy of documents which was submitted by him at the time of application, he lodged a complaint with the PCPD against the institution for non-compliance with his data access request.
Outcome
PCPD carried out an inspection to ascertain if the institution held any other records which should have been provided to the complainant. According to the institution, upon receipt of an application for the assistance scheme, they will file the hard copy of the application form and the supporting documents into a paper file. All processing records (e.g. notes of communications between the applicants and the institution, details of assessment made to the applications) will be input into the institution’s computer system.
Since the institution had only made reference to the complainant’s paper file upon receipt of his data access request, they overlooked the requested data storing in their computer system and thus did not provide the same to the complainant.
Upon the PCPD’s intervention, the institution furnished the complainant with a printout of the requested data stored in their computer system and also a written apology for the oversight.
Data user should bear in mind that the definition of “personal data” means any data “in a form in which access to or processing of the data is practicable” under the Ordinance. This would include both data stored in physical and electronic means. Extra attention should be paid when handling data access requests.
(Uploaded in March 2019)