Q: We are a car company dealing with sale and repair of cars. We would like to know if we are enquired by a new owner of a second hand car of the repair record of the previous owner of the car, whether disclosure of such record would contravene the Ordinance? Do we have an obligation to disclose the previous repair record of a car to a new owner?
A: In your question you ask whether the disclosure to a new owner of a second hand car of the repair record of the previous owner of that car would contravene the Ordinance. The first point to make is that the Ordinance is only relevant to this issue to the extent that such records amount to personal data. This would be the case only where the records directly or indirectly relate to a previous owner who is a living individual and it is reasonably practicable to identify the individual from the records by name or otherwise.
It is probable that at least some of the repair records to which you refer meet these requirements and hence are personal data. The provisions of the Ordinance of most direct relevance to your enquiry in relation to such personal data are those of Data Protection Principle 3 ("DPP3") in Schedule 1. DPP3 provides that personal data may be used only for a purpose for which the data were to be used at the time of collection, or a directly related purpose. The use, which in this context includes disclosure and transfer, of the personal data for any other purpose would require the express consent of the individual who is the subject of the data given voluntarily.
Such repair records are likely to contain data collected from the previous car owner, e.g. details of any accident resulting in the need for the repairs. Such data are presumably collected for the purpose of carrying out the repairs and providing future maintenance services. Applying the requirements of DPP3, you may disclose such data to the new owner for the same purpose, e.g. to assist the provision of future maintenance services. However, before disclosure of previous repair records to a new owner any identifying particulars of the previous owner should be removed, even if the identity of the previous owner is already known to the current owner, as such identifying particulars are not directly related to the purpose of disclosure.
In your question you also ask whether or not you have an obligation to disclose the previous repair record of a car to a new owner. Under the Ordinance there is no such obligation. However, whether any such obligation may exist on your part on account of any contract between yourself and the respective car owners or under any other law is a matter on which we are not in a position to comment.
We also would like to take this opportunity to remind you that DPP1(3) of the Ordinance requires data users to inform individuals from whom they collect personal data of which they are the subjects, e.g. when inviting an individual to fill in a form giving their personal details on the purchase of a vehicle, of the following :
(a) the purpose for which the data are to be used;
(b) the classes of person (if any) to whom the data may be transferred; and
(c) the individual rights to request access to and correction of personal data of which they are the subject and to whom to make such requests.