(AAB APPEAL NO.13/2016)
Photos of the balcony of a residence taken for the purpose of investigating water seepage problem – not personal data of the owner – showing only images such as slippers, rack and unidentifiable objects – owner of the flat not identifiable from the images – residential address alone constituted the Appellant’s personal data – his identity could be ascertained from the Land Registry
Coram:
Mr Liu Man Kin (Presiding Chairman)
Mr Lau Kwai Hin (Member)
Mr Ling Ho Wan (Member)
Date of Decision: 4 October 2016
The Complaint
The Appellant lodged a complaint against the estate manager of his residence who had, without giving prior notification to the Appellant, entered his flat and taken 14 photos showing mainly the balcony thereof and disclosed those photos together with the Appellant’s name and residential address to the resident of the flat on the floor below the Appellant’s.
The Commissioner’s Decision
The Commissioner found that the matters reported by the Appellant did not involve his personal data because the identity of the Appellant could not be ascertained from the photos and the residential address only, and that the Appellant had failed to provide sufficient information to show that the manager had disclosed his name to the resident of the flat below. The Commissioner concluded that the matters reported by the Appellant did not qualify as a “complaint” under section 37 of the Ordinance1 and decided not to carry out an investigation.
The Appeal
The AAB first dealt with the question of whether the Commissioner was correct to base his decision upon section 37(1) of the Ordinance to refuse to investigate the case. The AAB stated that in determining whether a complaint met the requirements set out in section 37(1)(b), namely, whether the act or practice specified therein was done by a “data user”, relating to “personal data”, and contravened the Ordinance, one would have to look at the act or practice specified in the complaint by taking the complainant’s case at its highest (i.e., assuming all the allegations in the complaint were true) in order to determine whether there was a case meeting the criteria in section 37(1)(b). If the answer was “No”, no “complaint” had been made and the Commissioner would have nothing to investigate. If the answer was “Yes”, the complainant had made a “complaint” to the Commissioner. The complainant then had to adduce evidence to show that he had prima facie evidence, and if the complainant was unable to do so, the Commissioner would be entitled to refuse to carry out an investigation of the complaint pursuant to section 39(2)(d) of the Ordinance.
The AAB agreed with the Commissioner that the photos did not constitute “personal data” as the Appellant could not be identified from the photos. The photos were taken for the purpose of investigating the water seepage problem and only captured images such as slippers, rack and unidentifiable objects. None of the photos showed the appearance of the Appellant. The AAB considered that even taking the Appellant’s case at its highest, the Appellant’s complaint did not relate to “personal data”, and the requirements in section 37(1)(b)(ii) of the Ordinance would not be satisfied. Hence, there was no complaint as defined in section 37 of the Ordinance in respect of the alleged personal data in the photographs.
With regard to the residential address, the AAB was of the view that the residential address alone would constitute “personal data” in the context of this case, as the owner’s identity could be ascertained directly or indirectly through the residential address by conducting a land search. However, as there was no evidence to show that the estate manager had disclosed the Appellant’s address or his name to the resident of the lower flat, the Commissioner was correct in not carrying out an investigation but the basis to do so should have been section 39(2)(d) instead of section 37(1) of the Ordinance.
The AAB’s Decision
The AAB dismissed the appeal.
1 Section 37: (1) An individual, or a relevant person on behalf of an individual, may make a complaint to the Commissioner about an act or practice (a) specified in the complaint; and (b) that (i) has been done or engaged in, or is being done or engaged in, as the case may be, by a data user specified in the complaint; (ii) relates to personal data of which the individual is or, in any case in which the data user is relying upon an exemption under Part 8, may be, the data subject; and (iii) may be a contravention of a requirement under this Ordinance (including section 28(4)).
(Uploaded in March 2019)