Case Notes

(AAB Appeal No.14 of 2018)

Data correction request – investigation report – assessment of bank on Appellant’s work performance – section 24(3)(b) – not satisfied the data was inaccurate – expression of opinion – section 25(2) – note showing different opinion – section 39(2)(ca) – primary subject matter not relate to personal data privacy – not venue for resolving labour disputes – legislative intent of sections 22 to 25 – section 39(2)(d) – decision reasonably made

Coram:
Ms. Elaine LIU Yuk-ling (Presiding Chairman)
Ms. CHAN Shin-kwan (Member)
Dr. CHAN Yee-shan (Member)

Date of Decision : 5 May 2020

The Complaint

The Appellant was a former employee of a bank. After the Appellant had resigned, the audit department of the bank published an investigation report on the mismanagement of the Appellant when he was the deputy supervisor of the bank’s credit card centre ("Investigation Report"). The bank provided the Appellant with a copy of the investigation report in compliance with his data access request but some of its contents were redacted.

The Appellant later made a data correction request covering nine proposed amendments to the title and contents of the investigation report. The bank sent a letter to the Appellant refusing to comply with his data correction request on the ground that the personal data to which the request related was solely an expression of opinion and was not inaccurate. However, the bank was willing to attach a note to the report to alert any third party reading it showing the Appellant’s disagreement with certain contents and reasoning of the report.

Dissatisfied with the bank’s failure to correct the report pursuant to his request, the Appellant filed a complaint with the Commissioner.

The Commissioner’s Decision

After obtaining the relevant information and documents for consideration, the Commissioner decided not to investigate the Appellant’s complaint further. The reasons are as follows:

1. Requests (1) and (9): The Appellant was the target of investigation. The bank was neither wrong nor unreasonable in mentioning the Appellant in the title and contents of the report. The bank was entitled to rely on section 24(3)(b) of the Ordinance to refuse to comply with the data correction request, i.e. the data to which the request related was not inaccurate.
2. Request (2): The Appellant claimed that he only "signed" the document as the deputy supervisor of the credit card centre. It was, however, the responsibility of the supervisor to "approve" the document. The bank eventually changed the words from "approved and signed” to "signed".
3. Requests (3) and (6): The name of bank staff inserted and the correction related to the description of the "procedure to be transferred to Dispute File" are not personal data of the Appellant.
4. Request (5): The Appellant and the bank held different views as to whether the Appellant had the authority to sign the "92 verification certificate" and to deal with write-off and fraud cases. The Commissioner accepted that the bank was entitled to rely on section 24(3)(b) (i.e. not satisfied that the data was inaccurate) as the ground for refusing to comply with the data correction request.
5. Requests (4), (7) and (8): The bank’s assessment of the Appellant’s work performance was an “expression of opinion”. The bank made a note showing the different opinion of the Appellant pursuant to section 25(2) of the Ordinance.

Dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB affirmed the Commissioner's decision made under section 39(2)(ca) of the Ordinance for not proceeding with the complaint, i.e. the primary subject matter of the Appellant's complaint did not relate to privacy. The contents of the data correction request were essentially about the Appellant’s work and the bank’s opinion on his performance, which related to the question of liability arising from his work in the course of employment.

The AAB pointed out that neither the Commissioner nor the AAB was the proper venue for adjudicating employment disputes. Neither of them should investigate or comment on whether the employer had made a correct assessment of the employee’s work performance. The Appellant could not rely on the complaint mechanism under the Ordinance and expect the Commissioner to investigate or comment on the differences between him and the bank on his performance in the course of employment, or to attempt to resolve their employment disputes. This was not the legislative intent of sections 22 to 25. The AAB considered that it was inappropriate for the Appellant to request the Commissioner to investigate and deal with his complaint, of which the subject matter did not relate to privacy.

In addition, the AAB considered that the Commissioner’s decision not to continue investigating the complaint was reasonable and was properly made under section 39(2)(d) of the Ordinance. Regarding Requests (1) and (9), the Appellant’s name was collected by the bank at the outset of his employment and was subsequently used for matters related to his work. Given that the investigation report concerned the description of his work and his performance, the Appellant’s name could not be regarded as having been used for new purposes. The bank’s evaluation of the Appellant’s performance in the course of his employment was an ongoing process, which included both facts and opinion. It was impracticable for the bank to provide the Appellant with a “Personal Information Collection Statement” in its day-to-day observation of his work performance. Accordingly, the AAB ruled that the Appellant’s allegation of the bank having acted in contravention of DPP 3(1) and DPP 1(3) could not be sustained. Besides, the AAB affirmed the Commissioner's ruling that the bank was entitled to refuse acceptance of the remaining items of the Appellant’s data correction request.

The AAB’s Decision

The AAB affirmed the decision of the Commissioner and dismissed this appeal.

(Uploaded in July 2020)