Skip to content

Case Notes

Case Notes

This case related to DPP2 - Accuracy and duration of retention of personal data , Section 37 of the Ordinance

Case No.:2018E02

Receipt of Letters Addressed to a Third Party at Residential Address

The Enquiry

An enquirer received letters addressed to Mr X by a company at his residential address many times. Although the enquirer had returned the letters with “No Such Person” marked on the envelopes, he still received letters addressed to Mr X by the company. The enquirer would like to know if he could lodge a complaint against the company with the PCPD.

Relevant Provisions of the Ordinance

Definitions of "Personal Data" and "Data Subject"

Under section 2(1) of the Ordinance, “Personal Data” means any data relating directly or indirectly to a living individual; from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and in a form in which access to or processing of the data is practicable. “Data Subject”, in relation to personal data, means the individual who is the subject of the data.

Accuracy of Personal Data

Data Protection Principle (DPP) 2(1) of Schedule 1 to the Ordinance stipulates that all practicable steps shall be taken to ensure that personal data is accurate having regard to the purpose (including any directly related purpose) for which the personal data is or is to be used.

Making a Complaint to the PCPD under the Ordinance

Under section 37 of the Ordinance, a complaint handled by the PCPD must be made by a data subject and may be a contravention of a requirement under the Ordinance made by a data user.

Our Response

As the enquirer has returned the letters to the company with “No Such Person” marked on the envelopes, before sending a letter to Mr X, the company should verify his correspondence address under practicable circumstances. If the company has not taken all practicable steps to ensure the accuracy of personal data, it may have contravened the requirements of DPP2(1).

However, as the enquirer’s address when coupled with Mr X’s name is not the enquirer’s “personal data”, the enquirer is not the “data subject” of this case. Hence, the case cannot be accepted as a “complaint” under section 37 of the Ordinance.

(Uploaded in September 2020)


Category : Provisions/DPPs/COPs/Guidelines :