Case Notes

(AAB Appeal No. 27 of 2019)

Data access request – did not use the required form for data access request – did not provide particulars of the request data (including specific time or reasonable period of the requested data) – no entitlement to access third party’s personal data – crux of the complaint not related to personal data privacy

Coram:
Mr. Erik Ignatius SHUM Sze-man (Presiding Chairman)
Mr Simon Chan Cham-man (Member)
Mr Lawrence Ng San-wa, MH(Member)

Date of Decision: 10 November 2020

The Complaint

The Appellant, by way of emails, requested various organisations to provide him relevant data of different cases, including:

1. The Appellant requested the Judiciary to provide him information relating to certain cases between 1993 and 2003, including the case number, date of conviction, information in relation to the judicial members and officers handling those cases. The Judiciary did not reply to his request.
2. The Appellant requested the Correctional Services Department to provide him information relating to a case which he allegedly suffered injustice during the period from 1993 to 2003, including the information of the two staff member of the Correctional Services Department who allegedly assaulted the Appellant during his incarceration. The Correctional Services Department did not reply to his request.
3. The Appellant requested the Immigration Department to provide him information relating to the Department requiring him to amend his date of birth. The Immigration Department did not reply to his request.

The Appellant then made a complaint to the Commissioner alleging that the above organisations had failed to comply with his data access request (“DAR”) pursuant to Personal Data (Privacy) Ordinance (“PDPO”).

The Commissioner’s Decision

Upon consideration of all relevant information, the Commissioner decided not to carry out an investigation into the Appellant’s complaint pursuant to section 39(2)(ca) of the PDPO and paragraph 8(d) of the Complaint Handling Policy. Reasons are as follows:-

1. According to the information provided by the Appellant, the requests lodged by him to the Judiciary, the Correctional Services Department and the Immigration Department respectively did not fulfil the requirements of a DAR under section 20(3) of the PDPO. The Appellant failed to provide clear particulars about his DARs, including the date, scope of the requested data and how the DAR was lodged. The Appellant also failed to use the prescribed form for lodging a DAR.
2. According to the information provided by the Appellant, the data that he requested from the Judiciary and the Correctional Service Department were data belonging to third parties, instead of his own personal data. As such, this should not be regarded as a DAR under the PDPO. The PDPO only allowed the data subject to lodge a request with the data user to obtain a copy of his own personal data, but not providing a route for the data subject to obtain others’ personal data.
3. The Commissioner took the view that the crux of the Appellant’s complaint was not related to personal data privacy and that the Commissioner could not act outside the ambit of the PDPO.

Being dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Commissioner’s decision and dismissed the appeal on the following grounds:-

1. The major information that the Appellant requested from the above organisations was not his own personal data, such as the case number, information in relation to the judicial members and officers handling those cases and the two staff members of the Correctional Services Department. These were obviously third parties’ personal data and should not be regarded as the Appellant’s personal data. Hence, the Appellant was not entitled to access such personal data by way of a DAR under the PDPO.
2. The Commissioner correctly applied the Court of Appeal judgment in HCAL60/2007. A data subject is only entitled to obtain a copy of his/ her personal data, as opposed to “see every document which refers to a data subject”.
3. A data user is entitled to refuse a DAR for failure to use the prescribed form as required under section 67 of the PDPO.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in February 2021)