Thank you very much for your email enquiry. Our general observations in respect of personal data privacy are as follows:
1. Under the Personal Data (Privacy) Ordinance (the “Ordinance”), “personal data” is defined as 1) information which relates to a living person, 2) from which it is practicable for the identity of the individual to be directly or indirectly ascertained, and 3) the data exists in a form in which access or processing is practicable.
Genetic data is a physiological data that an individual is born with and is directly related to the individual. It possesses the characteristics of being both unique to the individual and measurable. Although it may not be reasonably practicable for a lay person to ascertain the identity of an individual directly by merely looking at the genetic data itself, a particular individual could be identified when the data is linked with personal data in another database. Genetic data is sensitive in nature as it is unique and immutable, and it may contain an individual’s intimate information relating to health, mental condition or racial origin.
2. Our Office will not comment on the legality of any practices before looking into the details of the specific circumstances. If a genetic company controls the collection, holding, processing or use of the personal data in Hong Kong, it shall comply with the requirements, especially the data protection principles (DPP”) in schedule 1 under the Ordinance.
Genetic companies are required to notify the individuals concerned upon collection of genetic data from them regarding, amongst others, the purpose for which the data is to be used and the classes of persons to whom the data may be transferred (DPP1(3)). With respect to the use of genetic data, genetic companies are required not to use the collected data for a new purpose, which is not directly related to the original collection purpose, without the express and voluntary consent of the individuals concerned (DPP3). Furthermore, genetic companies are required not to retain the genetic data for longer than is necessary to fulfil the purpose for which the data is or is to be used, and to erase personal data that is no longer required (DPP2(2) and section 26).
3. Even if the genetic companies are registered outside Hong Kong and the Ordinance has no extraterritorial jurisdiction, the Privacy Commissioner may liaise with overseas personal data protection authorities for follow-up actions pursuant to international enforcement agreements and cooperation arrangements in appropriate cases where Hong Kong residents’ personal data is involved.
4. As genetic data of each person is unique and immutable, members of the public should be vigilant in controlling such data, and take notice and precautions of the following:
- Before giving consent to a genetic company to collect and process his genetic data, members of the public should clearly understand the purpose of data collection and read the Privacy Policy and Personal Information Collection Statement to ascertain what purpose the genetic data is to be collected, retained, used or shared by the company, and to whom it is to be transferred;
- If an individual does not want the genetic company to retain his genetic data, he may check if the company has offered any channels to request for erasure of his personal data no longer required for which the data was used.
- If members of the public find that their personal data are used improperly, they may consider making enquiries to and negotiating with the relevant companies. If they are not satisfied with the latter’s responses, they may lodge a complaint with the PCPD. Upon receipt of the complaint, the PCPD will contact the complainant and the party complained against to decide if an investigation is warranted. If the case involves criminal conduct, it will be referred to the Police for criminal investigation.
The Privacy Commissioner has issued the “Guidance on Collection and Use of Biometric Data” that assists data users who wish to collect biometric data to comply with the Ordinance.
(The above reply can be attributed to Mr Stephen Kai-yi Wong, Privacy Commissioner for Personal Data, Hong Kong)