Case Notes

(AAB Appeal No. 24 of 2019)

Employee of property management company – use of names and addresses of all owners – issue a letter relating to property management purpose or personal affairs – property management disputes – DPP3 – use of personal data for a new purpose – without data subject’s consent

Coram:
Mr Robert Pang Yiu-hung, SC (Chairman)
Ir Lay Wing-yan (Member)
Miss Carmen Chan Ka-Man (Member)

Date of Decision: 19 June 2020

The Complaint

The Appellant is the Incorporated Owners of a housing estate, representing the owners of the housing estate. The party being complained against is the property management company of the housing estate (“PCA”). The Appellant claimed that the PCA collected the owners’ personal data for property management purposes, while an employee of the PCA used the names and addresses of the owners of the housing estate without their consent for issuing a letter to them regarding some personal disputes between that employee and the chairman of the Incorporated Owners (“the Letter”). The Appellant took the view that the Letter was unrelated to the purpose of property management and complained to the Commissioner that the PCA used the owners’ personal data for a new purpose without obtaining the prescribed consent of the owners.

The PCA explained that it had reviewed the Letter drafted by the employee and agreed that the same be sent by the employee to all owners for the purposes of clarifying some untrue allegations made against the PCA in relation to property management.

The Commissioner’s Decision

After preliminary enquiry, the Commissioner took the view that it would be reasonable for the PCA to collect, hold and use the owners’ personal data for property management purposes and that the Letter sent by the PCA’s employee to all owners was for a purpose directly related to the purpose of property management because the Letter covered matters relating to the property management of that housing estate. Hence, according to section 39(2)(d) of the Personal Data (Privacy) Ordinance (“the Ordinance”), the Commissioner decided not to carry out an investigation of the Appellant’s complaint upon preliminary enquiry as there was no prima facie evidence of contravention of any requirement under the Personal Data (Privacy) Ordinance.

Dissatisfied with the Commissioner's decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB allowed the Appeal for the following reasons:

1. The AAB considered that the main purpose of the Letter was to express the employee’s own grievances, and not all the matters mentioned in the Letter were related to the housing estate concerned (some of the matters were related to another housing estate), and as such being unrelated to the property management work of the PCA. Although some of its content was indirectly related to property management, the Letter was issued by the employee in his own name and apparently served his personal purpose.
2. Since the PCA stated that the Letter was issued for the purposes of clarifying some untrue allegations made against the PCA in relation to property management, the AAB considered that it was necessary for the Commissioner to investigate the matters mentioned in the Letter and ascertained whether those matters were indeed related to property management. For instance, the AAB considered that the PCA was merely an external service provider appointed by the Appellant to provide property management service. If the PCA tried to use the personal data of the owners to meddle with the internal governance of the Appellant, it would likely amount to a misuse of the personal data.
3. The AAB took the view that the Commissioner did not sufficiently consider the above matters before closing the case.

The AAB’s Decision

The appeal was allowed and the complaint was remitted for the Commissioner’s investigation.

(Uploaded in July 2020)