Whether a service applicant could request a company to delete his personal data
An enquirer had provided his personal data to a company when subscribing to the company’s service. Given that the company did not provide service to him, the enquirer requested the company to delete his personal data. The enquirer would like to know if he could lodge a complaint with the PCPD if the company refused his request.
Relevant Provisions of the Ordinance and the Code
Retention of Personal Data
Data Protection Principle (DPP) 2(2) of Schedule 1 to the Personal Data (Privacy) Ordinance (the Ordinance) provides that personal data shall not be kept longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is or is to be used.
In addition, section 26(1) of the Ordinance further requires a data user to erase personal data held when the data is no longer required for the purpose (including any directly related purpose) for which the data was used unless (a) any such erasure is prohibited under any law; or (b) it is in the public interest (including historical interest) for the data not to be erased.
Our Comment
There is no provision under the Ordinance which confers an individual the right to request a data user to delete his personal data as he may wish, hence the company would not have contravened the requirements under the Ordinance by refusing the enquirer’s request.
The company is however obliged to comply with the requirements under DPP 2(2) and section 26(1) of the Ordinance when retaining personal data. Generally speaking, if a service applicant’s personal data held by the company can no longer be used to fulfill and/or has already fulfilled the purpose (including any directly related purpose) for which the data was collected, the company should erase the service applicant’s data unless the retention of the data is in accordance with the statutory requirements or is in the public interest.
Service applicants may consider making enquiries with the company on its retention policy so as to understand if the company has retained their personal data longer than necessary.
(Uploaded in March 2019)