Unauthorized disclosure of the complainant's personal data by a property management company to a neighbour - the purpose of disclosure was to facilitate civil litigation instituted by the neighbour - no prescribed consent obtained from the data subject - DPP3.
The Complaint
The neighbour of the complainant complained to the property management company against the complainant about noise and dripping water. In handling the complaint, the property management company collected information relating to the complaint which contained the personal data of the complainant. Later, pursuant to the request of the neighbour, the property management company disclosed details about the complaint to the neighbour. The complainant subsequently discovered that the neighbour had used information about the complaint in a civil action taken against her. The complainant therefore complained to the Privacy Commissioner against the property management company for having disclosed her personal data to the neighbour without her consent.
Findings of the Privacy Commissioner
The Privacy Commissioner conducted a preliminary enquiry. In the course of that enquiry the property management company explained that the data were collected for the purpose of handling the dispute between the complainant and the neighbour. It also confirmed disclosure of such data to the neighbour. The available evidence indicated that the neighbour, having obtained the personal data of the complainant from the property management company, then used the data to claim against the complainant for compensation relating to the dispute.
Having considered the purposes of data collection by the management company and the purposes of disclosure to the neighbour, the Privacy Commissioner was of the view that the disclosure had been made for a purpose directly related to the purposes of collection, namely to handle and follow up the dispute between the complainant and her neighbour. Such use of the complainant's personal data was therefore consistent with the requirement of DPP3.
Taking into account the use of the relevant data by the neighbour in the civil action instituted against the complainant, the Privacy Commissioner was also of the view that section 58(2) of the Ordinance was applicable to exempt the data from DPP3. The Privacy Commissioner considered that such use of the data by the property management company was for the purpose of remedying "unlawful or seriously improper conduct" within the meaning of section 58(1)(d) of the Ordinance.
In view of the above, the Privacy Commissioner considered investigation of the complaint unnecessary and exercised his discretion to refuse investigation pursuant to section 39(2)(d) of the Ordinance.
The Appeal
The complainant appealed to the AAB against the decision of the Privacy Commissioner not to investigate. The AAB agreed with the Privacy Commissioner that there was no change of use of the complainant's personal data by the property management company in disclosing the data to the neighbour. The AAB opined that the management company had collected the personal data for the purposes of handling the dispute between the complainant and the neighbour and that the disclosure was directly related to the purposes of collection. It was found that such use of the complainant's personal data by the management company was consistent with DPP3 even without the prescribed consent of the complainant. The AAB however reserved its position regarding the applicability of an exemption in the case.
The AAB's Decision
The AAB upheld the Privacy Commissioner's decision and dismissed the appeal.