Skip to content

Media Statements

Media Statement - Legal Issues relating to Personal Data involved in Governments distribution of Reusable Masks

Date:7 May 2020

Legal Issues relating to Personal Data involved in
Government’s distribution of Reusable Masks


The Privacy Commissioner for Personal Data, Hong Kong (PCPD) has received more than thirty enquiries and complaints from members of the public, netizens, professionals and the media about the online registration system concerned.  The PCPD also notes the views expressed at social media platforms by other parties (including Legislative Council Members) and the explanation of the Innovation and Technology in its media statement today. In the circumstances, the PCPD gives a general response from the perspective of the Personal Data (Privacy) Ordinance (PDPO) as follows:
 

  • The purpose of collection and use of data must be legitimate. The PDPO provides that the data collected should be adequate but not excessive;
     
  • If data matching procedures (by which two sets of personal data collected for different purposes are compared electronically) are involved, collection and use of data subjects’ phone numbers for issuing SMS notifications of the matching results is a usual practice in compliance with the relevant legal requirements;
     
  • In accordance with the PDPO, the use of personal data collected should be limited to the purpose stated at the time of collection or other purposes with express consent.  The retention period should not be too long. If transfer of the personal data is necessary, it should only be transferred to the classes of persons or organisations stated or covered by express consent. It is nevertheless quite understandable that data subjects would like to be apprised of more detailed and clearer information to allay their concerns; and
     
  • The PCPD reminds members of the public to stay vigilant when providing personal data and follow the registration procedures as published in official website only. The public should ascertain the registration website and beware of phishing websites. If members of the public would like others to register on their behalf, they should also take extra caution to prevent their personal data from being lost or stolen accidentally.

-End-