Case Notes

(AAB APPEAL NO.18/2020)

Complaint related to an individual’s reputation and wrongful description of his personal capacity in a letter – primary subject matter did not relate to protection of personal data privacy – remedial measures taken – discretion not to investigate the complaint duly exercised – further investigation cannot reasonably be expected to bring about a more satisfactory result

Coram:
Mr Erik Ignatius SHUM Sze-man (Chairman)
Ms Mindy HO Sze-may (Member)
Miss Julia LAU Pui-g (Member)

Date of Decision: 4 February 2021

The Complaint

The Appellant was previously employed by an organisation (“the Organisation”) and acted as the Chairman of a staff union of the Organisation (“the Union”). The Union received an anonymous letter containing copies of a few pages of the medical reports belonged to a former employee of the Organisation (“the Reports”). In his capacity as the Chairman of the Union, the Appellant met with the Organisation and passed the Reports to the same.

The Organisation tried to look into the source of the leakage of the Reports but was to no avail. The Appellant subsequently noticed that the Organisation had sent a letter to one Ms Tse, another former employee of the Organisation, for enquiry (“the Letter”). It was stated in the Letter that it was the Appellant who passed the Reports to the Organisation. The Appellant contended that it was factually incorrect as he received the Reports and gave them to the Organisation in his capacity as the Chairman of the Union but not in his personal capacity. Further, the Appellant considered that the content of the Letter caused Ms Tse to misunderstand that he reported the matter to the Organisation, which “leaked” his identity to Ms Tse and “degraded” his reputation. The Appellant therefore lodged a complaint to the Privacy Commissioner.

The Privacy Commissioner’s Decision

First, the Privacy Commissioner could not find any evidence indicating that there was any damage caused to the Appellant’s reputation, and reputation itself did not constitute “personal data” as defined under the PDPO. Further, given that there was no evidence indicating that the said leakage was caused by the Organisation, the Privacy Commissioner exercised the discretion under sections 39(2)(ca) and 39(2)(d) of the PDPO not to carry out an investigation into the Appellant’s complaint. Being dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Privacy Commissioner’s decision and agreed that:

1. There was no evidence indicating that the leakage of the Reports was caused by any malpractice on the part of the Organisation. In any event, the Organisation had taken a series of remedial measures, including the engagement of an independent consultant to review and strengthen its data management system; and also the implementation of measures as recommended to enhance data security and provision of training to its employees in order to enhance their awareness of personal data privacy. The Organisation had confirmed that if a similar situation arises in future, it will only disclose the source of the information with reference to the informant’s capacity instead of identifying the informant by name.
2. Further, even assuming that the Privacy Commissioner continued to investigate into the complaint and found the Appellant’s complaint substantiated, in view of the aforesaid remedial measures taken by the Organisation, the Privacy Commissioner’s investigation could not bring about any other concrete results. In this context, there was no need for the Privacy Commissioner to issue an Enforcement Notice as requested by the Appellant.
3. The Appellant’s complaint was primarily related to his reputation and the wrongful description of his capacity, as opposed to divulging of his name or any other personal data in the Letter (or under any other circumstances). The subject of the Appellant’s complaint was not related to protection of his personal data privacy.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in May 2021)