(AAB APPEAL NO.3/2016)
Identity theft in voter registration – collection of personal data was not unlawful or unfair when collection was passive – all reasonably practicable steps had been taken to ensure accuracy of the register of voters – to balance between personal data privacy rights and voting rights of individuals
Coram:
Ms Cissy Lam King-sze (Presiding Chairman)
Mr Lam Wai-choi (Member)
Mr Law Chi-yuen (Member)
Date of Decision: 6 December 2016
The Complaint
Someone had forged the Appellant’s signature and submitted a false voter registration form to the Registration and Electoral Office (REO) using the personal particulars of the Appellant. Subsequently, the Appellant’s personal particulars had been included in the provisional register of voters. The Appellant discovered the identity theft upon receiving the Notice of Registration from the REO and had since complained to the REO by telephone, email and fax but refused to provide a signed written notice to REO for deletion of his personal particulars. The Appellant lodged a complaint to the PCPD against REO for “unlawfully obtaining” his personal particulars and for failing to verify his identity before including his personal particulars in the final register of voters.
The Commissioner’s Decision
The Commissioner found that there was no evidence to substantiate that REO had unlawfully obtained the Appellant’s personal data. The REO took a passive role in receiving the application for voter registration which contained the Appellant’s personal particulars. The Commissioner further found that the REO had taken all reasonably practicable steps to ensure the accuracy of the personal data in the final register of voters, in particular, the Notice of Registration which was received by the Appellant and which enabled the Appellant to find out the fact that someone had impersonated him to submit a false application. Having regard also to the fact that the Government had openly stated that it would take further measures to enhance the verification of applicants’ identities and that REO had already referred the case to the police for criminal investigation, the Commissioner exercised his discretion not to investigate the complaint further pursuant to section 39(2)(d) of the Ordinance and paragraph 8(h) of the Commissioner’s Complaint Handling Policy.
The Appeal
The AAB considered that the REO was not the party which obtained the Appellant’s personal data illegally or submitted the false voter registration form. Since REO was discharging its statutory obligations by collecting the voter registration form for purposes directly related to the statutory obligations of the Electoral Registration Officer, there was nothing illegal or unfair about it, and the personal data collected was not excessive. Accordingly, the Electoral Registration Officer and the REO had not breached DPP1.
The AAB also considered that the use of the Appellant’s personal data in the voter registration form to issue the Notice of Registration and the subsequent inclusion of the Appellant’s particulars in the provisional and final registers of voters complied with the statutory requirements and the relevant timelines. Such use of the Appellant’s personal data by the REO did not contravene the requirements of DPP3 as it was consistent with the purpose of collection.
In respect of DPP2(1), the AAB considered that the personal data of the Appellant stated on the false voter registration form was basically not incorrect, and the REO had a mechanism to enable voters to amend any incorrect data. It was stated clearly in the Notice of Registration that the Appellant could amend his personal data by notifying the Electoral Registration Officer on or before 25 August 2015, and the voter registration form also stated that it was an offence to provide false, incorrect or misleading information. The AAB agreed with the Commissioner’s finding that the REO had already taken reasonably practicable steps to ensure the accuracy of the data and to prevent identity fraud in submitting a false voter registration.
The AAB took the view that the REO had not contravened DPP2(2) in respect of its retention of the Appellant’s personal data on the final register of voters. On the ground that the Appellant only lodged his complaint to the REO after the Appellant’s personal data had been included in the provisional register of voters. The Electoral Registration Officer had no power to amend or delete entries in the register of voters unless in accordance with the relevant legal requirements and prescribed time frame to put the Appellant’s name and address in the omission lists, or with the approval of the Revising Officer.
The AAB agreed with the Commissioner’s view that a balance must be struck between the personal data privacy rights and the right to vote of individuals, both of which were important rights. The AAB considered that REO’s declaration system based on honesty of voters did not contravene the requirements of the Ordinance as there was no restriction on the format or means regarding the collection of personal data under the Ordinance.
The AAB was sympathetic with the Appellant but took the view that REO had to follow the statutory requirements to register or remove a voter and it would not be permissible to remove a registration in response to a telephone enquiry or a letter from the Commissioner. As the REO had already referred the Appellant’s complaint to the police for investigation, the AAB agreed that further investigation by the Commissioner would not bring about a more satisfactory result. The AAB also requested the REO to inform the Constitutional and Mainland Affairs Bureau about this case for consideration in the review of the voter registration system in future.
The AAB’s Decision
The AAB dismissed the appeal.
(Uploaded in March 2019)