Q: We are a bank. We have received a letter from a firm of solicitors acting for the administrator of the estate of a deceased person. We are requested to disclose certain records in relation to accounts which are in the name of the deceased. However the records also include information relating to third parties. Is such disclosure a contravention of the Ordinance?
A: The first point to note is that the Ordinance is concerned with personal data, which generally speaking are recorded information relating to living individuals. Hence, insofar as the records concerned relate to the deceased and no living individual, they do not contain personal data and are not subject to the requirements of the Ordinance. However, according to your letter the records include information relating to third parties. Assuming that some or all of the said third parties are living individuals who are identified in the records concerned, disclosure of the records relating to them to the firm of solicitors would be disclosure of personal data. Hence, this is a matter that is subject to the requirements of the Ordinance.
The relevant requirements are those of data protection principle ("DPP")3 in Schedule 1. DPP3 provides that a data user may not use, which includes "disclose" or "transfer", personal data other than for a purpose for which the data were to be used when they were collected or a directly related purpose without the "prescribed consent" of the individual who is the subject of the data. Prescribed consent is defined under the Ordinance to mean, in essence, express consent given voluntarily.
It seems to us that the purpose for which you are being asked to disclose the records concerned, the administration of a deceased estate, is not the purpose for which the personal data in the records were likely to have been collected or a directly related purpose. Hence, to comply with the Ordinance it would be necessary for you to obtain the prior express consent given voluntarily of the individuals concerned for the disclosure. If one or more of the said individuals do not so consent, you will need to consider whether any of the exemptions from the requirements of DPP3, as provided for in Part VIII of the Ordinance, applies. For example, if the non-disclosure of the record concerned would prevent the administrator of the estate from remedying unlawful conduct, such as unlawful withdrawal of funds from the accounts, the disclosure of the records would be allowed pursuant to sections 58(1)(d) and 58(2) of the Ordinance. However, before acting on this or any other exemption we would advise you to obtain legal advice on its applicability to the particular circumstances of your case.