Case Notes

(AAB Appeal No.2 of 2017)

Data correction request – consumer credit data – section 39(2)(d) of the PDPO – remedial measures taken – further investigation cannot reasonably be expected to bring about a more satisfactory result – the personal data not maintained in the Appellant’s profile did not constitute his personal data

Coram:
Mr Richard KHAW Wei-kiang, S.C. (Chairman)
Mr Kenneth LAU Kwai-hin (Member)
Ms TONG Choi-cheng (Member)

Date of Decision : 28 April 2020

The Complaint

The Appellant received various letters from a bank (“Bank A”) and a debt collection company posted to his residential address (“the Address”), the contents of which were related to collection of debts from him. The Appellant claimed that such letters were related to the bank account of another individual (“Ms E”) and were in no way associated with him. The Appellant subsequently noted that the Address was provided to Bank A by a credit reference agency (“the Credit Reference Agency”).

The Appellant first complained to Bank A and the debt collection company but was asked to contact the Credit Reference Agency directly to rectify the relevant information. The Appellant subsequently made a data correction request to the Credit Reference Agency and requested to have the Address removed from Ms E’s record (“the Relevant Address Record”). Nonetheless, the Credit Reference Agency stated that the relevant information was previously provided by another bank (“Bank B”) whereby the Relevant Address Record was confirmed to be Ms E’s “correct address” at the material time. The Credit Reference Agency thus refused to comply with the Appellant’s data correction request.

The Appellant also considered that the Credit Reference Agency failed to take all practicable steps in ensuring the accuracy of the personal data, thereby contravening the requirements of Data Protection Principle 2.

The Privacy Commissioner’s Decision

Upon investigation, the Privacy Commissioner decided to exercise discretion not to further investigate into the Appellant’s complaint under section 39(2)(d) of the PDPO for the following reasons:

1. The Credit Reference Agency was not compiling information about the Appellant when it collected the Relevant Address Record; and
2. The Relevant Address Record had been removed from the databases of the Credit Reference Agency and Bank B. In other words, the issues relating to the accuracy of personal data had been resolved.

Dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB affirmed the Privacy Commissioner’s decision not to pursue the complaint any further under section 39(2)(d) of the PDPO as remedial measures had already been taken by the Credit Reference Agency and Bank B in removing the Relevant Address Record from their databases. Further, the AAB agreed with the Privacy Commissioner that the subject matter of the Appellant’s complaint, i.e. the maintaining of inaccurate personal data by the Credit Reference Agency had already been dealt with, and hence any further investigation would not bring about a more satisfactory result.

Although the above views were sufficient to refute the arguments advanced by the Appellant, for the sake of completeness, the AAB further considered the Appellant’s grounds of appeal, which were all rejected by the AAB as follows:

1. Bank A and Bank B obtained the Relevant Address Record as data users in the first place, whether it was collected directly from Ms E or the Credit Reference Agency. Hence, Ms E was the data subject and the Relevant Address Record did not constitute the Appellant’s personal data.
2. Given that the Relevant Address Record did not constitute the Appellant’s personal data, his complaint against the Credit Reference Agency could not be substantiated.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in July 2020)