Q: We are a local post-secondary educational institute. We will sometimes issue reference letter on a student to a third party, such as another educational institution, upon the request of the student concerned. It is a common practice among tertiary institutions in a particular country that students concerned will sign a declaration giving up their rights of access to the reference letters issued by the institutions. The question is whether a student in Hong Kong could similarly be required to relinquish or waive his right of access under the Personal Data (Privacy) Ordinance ("the Ordinance") to certain personal data such as reference letters.
A: As a matter of policy, this Office is opposed to the imposition of such a requirement on the data subject as it would amount to an attempt to derogate from the rights granted to individuals by the Ordinance. The requirement would be particularly unfair to students if the giving of such a "waiver" is made a condition of providing the reference. In any case, we are of the view that if an individual makes a data access request, your obligation to comply with it under section 19(1) of the Ordinance will be unaffected by any such previous waiver by the individual.