Case Notes

(AAB APPEAL NO.12/2020)

Home visit without appointment – no excessive collection of the student’s personal data – collection of personal data adopting various means in accordance with the requirements of the PDPO – data user handled data correction request properly – Appellant not entitled to access information not constituting his personal data – refusal to comply with data access request made by the Appellant relying on the exemption provided under section 58 of the PDPO – discretion not to further investigate the complaint duly exercised

Coram:
Mr. CHEUNG Kam-leung (Presiding Chairman)
Mr. Simon CHAN Cham-man (Member)
Mr Lawrence Ng San-wa, MH (Member)

Date of Decision: 9 August 2021

The Complaint

This case stemmed from controversies arising from a government body (“Government Body”) which confirmed the eligibility of the Appellant’s son in respect of his primary one admission application by conducting home visits without appointment. The Appellant's son was an applicant under the Primary One Admission System. The impartiality of the Primary One Admission System was based on an applicant's accurate declaration of his residential address, and the Government Body conducted random sampling surveys to verify applications.

The Appellant considered that the Government Body (i) collected various personal data of his son (including data about his daily routine) during the investigation over his residential address in contravention of the relevant requirements under the PDPO; and (ii) failed to comply with the data access requests lodged by the Appellant on behalf of his son (including requesting for application records and reports concerning his son’s application for primary one admission, the written replies issued by the Government Body in response to the complaint made by the Appellant and all information recorded by the Government Body in verifying his son’s residential address). The Appellant therefore lodged a complaint to the Privacy Commissioner.

The Privacy Commissioner’s Decision

Upon receipt of the complaint from the Appellant, the Privacy Commissioner attempted to mediate the dispute, but to no avail.

Upon investigation, the Privacy Commissioner considered that the Government Body collected the personal data of the Appellant’s son for the purpose of verifying his residential address, which was directly related to the lawful function of the Government Body in relation to the Primary One Admission System. Therefore, there was no excessive collection of personal data.

Further, with regard to the Appellant’s request made to the Government Body in amending or removing the relevant content of the home visit report, according to section 25(2) of the PDPO, where the personal data to which a data correction request relates is an expression of opinion and the data user concerned is not satisfied that the opinion is inaccurate, the data user shall make a note to the effect that the data subject disputes the data user’s opinion in that regard. The Privacy Commissioner considered that the Government Body had dealt with the Appellant’s data correction request as per the requirements.

In respect of the Appellant’s data access requests, the Privacy Commissioner noted that the Government Body had provided the requested data to the Appellant on multiple occasions. Even though some internal documents of the Government Body contained the personal data of the Appellant’s son, the Privacy Commissioner considered that the Government Body was entitled to rely on the exemption provided under section 58 of the PDPO in refusing to comply with his requests, taking into account the purpose of the verification work done by the Government Body in preventing any false declaration made by applicants and detecting the criminal acts concerned.

The Privacy Commissioner therefore exercised discretion under sections 39(2)(ca) and 39(2)(d) of the PDPO not to carry out further investigation into the Appellant’s complaint. Being dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Privacy Commissioner’s decision and dismissed the Appellant’s appeal for the following reasons:

1. The Government Body collected information on the Appellant’s son’s daily routine and after-school activities which might be used to determine whether the address declared by the Appellant was true. The purpose of collecting the floor plan of the Appellant’s address was to assess whether the address was his son's sole and main residence. The AAB did not consider that there was any excessive / unnecessary collection of personal data. Subject to compliance with the relevant requirements of the PDPO, the Government Body might adopt different means and measures (including home visits without appointment) in collecting personal data.
2. The Appellant claimed that certain parts of the home visit report were factually inaccurate. The Government Body was not satisfied that the records were inaccurate, but indicated that it would make a note in the relevant record. The ABB considered that the measure taken by the Government Body was proper and reasonable in this regard.
3. With regard to the internal policies and documents of the Government Body concerning the verification process, the internal policies did not constitute the Appellant’s personal data and he was not entitled to rely on the PDPO in requesting for access to the same. Besides, as the disclosure of the relevant information to parents under investigations would likely prejudice the relevant purposes specified under the exemption provisions of section 58 of the PDPO, the Government Body was entitled to rely on the PDPO in refusing to comply with the Appellant’s data access requests.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in March 2024)