(AAB Appeal No. 65 of 2015)
Redacting printing dates and recipients’ names in complying with data access requests – section 37(1)(b)(ii) – Appellant was not the data subject – the Board has no jurisdiction to hear an appeal against the Commissioner’s decision made under section 37 – section 26(1)(b) not apply to redaction of third party’s personal data.
Coram:
Mr. Alan Ng Man-sang (Deputy Chairman)
Mr. Chow Chun-keung (Member)
Mr. Lam Tak-hing (Member)
The Complaint
The Appellant was a prisoner. He made two data access requests against the prison for obtaining copies of his mailing records from the prison on certain dates (“DARs”). He complained to the Commissioner against the prison for redacting the printing dates and the recipients’ names from the relevant records provided to him in response to his DARs.
The Commissioner’s Decision
The Commissioner was of the view that both the printing dates and the recipients’ names were not the Appellant’s “personal data” within the meaning of the Ordinance. A “complaint” under section 37 of the Ordinance requires, among other things, that the “personal data” of the complainant is implicated. As the printing dates and the recipients’ names were not the Appellant’s “personal data”, the Commissioner notified the Appellant of his decision not to proceed with the complaint. Dissatisfied with the Commissioner’s decision, the Appellant appealed to the AAB.
The Appeal
The AAB affirmed the Commissioner’s view that the recipient’s names of the letters were the personal data of the recipients, who were the data subjects of such data. The Appellant was not the data subject nor a ‘relevant person’ acting on behalf of the recipients. Hence, the Appellant did not fulfill the requirement of section 37(1)(b)(ii) for lodging his complaint with the Commissioner about the redaction of the recipients’ names.
The AAB made it clear that its jurisdiction in hearing appeals in respect of the Ordinance was limited to 7 kinds of decisions set out in Item 29 of the Schedule to the Administrative Appeals Board Ordinance (Cap.442). These did not include the Commissioner’s decision made under section 37 of the Ordinance, which fell outside the ambit of the AAB’s power.
The AAB also agreed with the Commissioner that section 26(1)(b) of the Ordinance did not apply to the present case, which related to erasure of personal data no longer required for the collection purpose. This should be distinguished from redaction of personal data of a third party in complying with a data access request.
The AAB’s Decision
The appeal was dismissed.
(Uploaded in March 2019)