Case Notes

(AAB APPEAL NO.1/2020)

Data access request – failure to provide substantive grounds and evidence – failure to provide identity information – failure to provide specific time or reasonable period of the requested data – 2 or more similar access requests made

Coram:
Mr Erik Ignatius Shum Sze-man (Presiding Chairman)
Mr Simon Chan Cham-man (Member)
Mr Lawrence Ng San-wa, MH (Member)

Date of Decision: 10 November 2020

The Complaint

The Appellant alleged that he was the victim of a traffic accident that happened more than 30 years ago, with his name at the time different from his current name. The Appellant wished to follow-up with the traffic accident and made a data access request (“DAR”) to the law enforcement agency by providing the following information: (1) the traffic accident occurred approximately between 1985 and 1990 (when the Appellant was still a child); (2) the place of the traffic accident and the hospital that the Appellant was admitted to after the accident; (3) the fact that he was approached by the officers of the law enforcement agency at that time in handling traffic accidents (no names provided); and (4) no criminal prosecution was lodged against the alleged wrongdoer that caused the Appellant’s injury at the material time.

The law enforcement agency responded to the Appellant in writing that it did not hold the requested personal data. Being dissatisfied, the Appellant insisted that the law enforcement agency should have in possession a report book that recorded all traffic cases manually, recording the information of daily cases; and considered that his personal data in relation to the traffic accident must have been retained. Besides, the Appellant also accused the law enforcement agency of deliberate concealment and erasure of the requested information. Therefore, the Appellant made a complaint to the Commissioner.

The Commissioner’s Decision

Upon the Commissioner’s preliminary enquiry, there was no evidence found to substantiate the Appellant’s allegation that the law enforcement agency concealed and /or erased the requested personal data, thereby deliberately refused to comply with the Appellant’s DAR. There was also no prima facie evidence to support any contravention of the requirements of the Personal Data (Privacy) Ordinance (“PDPO”). Hence, the Commissioner exercised discretion under s.39(2)(ca) and 39(2)(d) of the PDPO not to carry out an investigation into the Appellant’s complaint. Being dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Commissioner’s decision not to further investigate the matter and dismissed the Appellant’s case on the following grounds:-

1. the Appellant failed to substantiate his complaints with evidence against the law enforcement agency that it did hold the requested data;
2. the law enforcement agency was entitled under section 20(1)(a)(i) of the PDPO to refuse to comply with the Appellant’s DAR in the light of the Appellant’s inability to satisfy the law enforcement agency with his identity (i.e. no information can be provided by the Appellant to the law enforcement agency that he himself was the one who bears the former name in making the subject DAR);
3. the law enforcement agency was entitled under section 20(3)(b) of the PDPO to refuse to comply with the Appellant’s DAR in the light of the Appellant’s inability to provide the law enforcement agency with the details as to the specific time or reasonable period of the data so requested; and
4. the law enforcement agency was entitled under section 20(3)(c)(i) of the PDPO to refuse to comply with the Appellant’s DAR as the Appellant had previously made three other DARs which were substantially the same or similar in nature.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in February 2021)