Case Notes

(AAB APPEAL NO.28/2020)

Data access request – failure to provide clarification of the personal data requested – requesting document for the purpose of the Appellant’s disciplinary proceedings – discretion not to further investigate the complaint duly exercised

Coram:
Mr Erik Ignatius SHUM Sze-man (Chairman)
Mr Eugene CHAN Yat-him (Member)
Ir LAU Wing-yan (Member)

Date of Decision: 19 February 2021

The Complaint

The Appellant previously made a data access request to his employer (“the Employer”) requesting all relevant investigation reports, documents and correspondence associated with the disciplinary proceedings instituted by the Employer against him (“1^st DAR”). The Employer provided the Appellant with documents in response to his 1^st DAR. The Appellant subsequently made another data access request (“2^nd DAR”) to the Employer requesting all relevant documents, records or materials with reference made to five different paragraphs of the Employer’s procedural guidelines for the aforesaid disciplinary proceedings. The Employer subsequently requested the Appellant to clarify the personal data as requested in the 2^nd DAR, but the Appellant replied by making a verbatim reproduction of the 2^nd DAR without providing any further clarification. As the Employer did not comply with the Appellant’s 2^nd DAR, the Appellant lodged a complaint to the Privacy Commissioner.

The Privacy Commissioner’s Decision

There was no dispute in relation to the 1^st DAR. With regard to the 2^nd DAR, the Privacy Commissioner agreed that the description of the requested documents was unclear. Given that the Appellant did not respond to the Employer’s reasonable request for clarification, there was no valid data access request in this instance. In other words, the Employer was not required to comply with the 2^nd DAR. Besides, there were reasons for the Privacy Commissioner to believe that the Appellant’s 2^nd DAR did not appear to be made for the purpose of ascertaining the kinds of personal data held by the Employer, but was made for other purposes irrelevant to personal data privacy.

According to the principles established in Wu Kit Ping v Administrative Appeals Board [2007] 4 HKLRD 849, the purpose of lodging a data access request is not to supplement rights of discovery in legal proceedings or to enable a data subject to locate information for other purposes. The Privacy Commissioner considered that such principles should equally apply to the disciplinary proceedings that the Appellant was facing. Hence, the Privacy Commissioner exercised the discretion under sections 39(2)(ca) and 39(2)(d) of the PDPO not to carry out any further investigation into the Appellant’s complaint. Being dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Privacy Commissioner’s decision and dismissed the appeal on the following grounds:

1. The 2^nd DAR was far too vague and general; and hence was not a valid data access request which the Employer had to comply with. The description of the said request was only related to certain references to the paragraphs in the Employer’s procedural guidelines for disciplinary proceedings, but the Appellant failed to specify the nature and type of documents requested therein so as to enable the Employer to comply with the 2^nd DAR.
2. It is not the legislative intent of the PDPO to facilitate data subjects to gain access to documents or information for other purposes, especially when discovery of documents in litigation and disciplinary proceedings is governed by other legal principles and procedures. Though the disciplinary proceedings in the present case were not legal proceedings, the Privacy Commissioner had duly applied the same principle in the Wu Kit Ping case in respect of such disciplinary proceedings.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in May 2021)