Case Notes

(AAB APPEAL NO.4/2020)

Data access request – no entitlement to access third party’s personal data – failure to use the required form for data access request – not all documents that refer to a data access requestor contain the requestor's personal data and are required to be disclosed

Coram:
Mr Erik Ignatius Shum Sze-man (Presiding Chairman)
Mr Simon Chan Cham-man (Member)
Mr Lawrence Ng San-wa, MH (Member)

Date of Decision: 10 November 2020

The Complaint

The Appellant averred that he had submitted a data access request (“DAR”) to the law enforcement agency with details of four criminal cases that involved him and happened between the years of 1993 to 1998 through the “Provided Crime Information” page of the agency’s e-report centre online, and requested for the provision of the names or identification numbers of the enforcement officers who were responsible for the said four cases at the material time.

The law enforcement agency considered that the Appellant did not make the DAR pursuant to s.18(1) of the Personal Data (Privacy) Ordinance (“PDPO”) (i.e. pursuant to the prescribed form provided by the agency) and hence, it was not required to comply with the DAR within 40 days upon receiving the Appellant’s said DAR under s.19 (1) of the PDPO. Upon the Appellant’s further enquiry, the law enforcement agency notified the Appellant in writing that the relevant case files concerning the four cases had been destroyed owing to considerable lapse of time; and in any event, the names and identification numbers of the enforcement officers were third parties’ personal data such that the Appellant was not entitled to such requested data.

The Appellant made a complaint to the Commissioner arguing that the law enforcement agency had failed to respond to his DAR.

The Commissioner’s Decision

The Commissioner did not find evidence to support any contravention of the requirements of the PDPO and exercised discretion under s.39(2)(ca) and 39(2)(d) of the PDPO not to carry out an investigation into the Appellant’s complaint. Being dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Commissioner’s decision and dismissed the appeal on the following grounds:-

1. A data user is entitled to refuse a DAR for failure to use the prescribed form as required under s.67 of the PDPO;
2. A data subject is only entitled to obtain a copy of his/ her personal data, as opposed to “see every document which refers to a data subject” (by applying the Court of Appeal’s decision in HCAL 60/2007). Given that the names or identification numbers of the enforcement officers concerned were third parties’ personal data, the Appellant was not entitled to access such personal data by way of a data access request under the PDPO; and
3. The primary subject matter of the Appellant’s complaint was the acquisition of the names or identification numbers of the enforcement officers in furtherance of his ultimate aim to complain against the concerned officers; which was plainly unrelated to protection of his personal data privacy rights provided for under the PDPO.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in February 2021)