Section 30 of the Personal Data (Privacy) Ordinance, which provides for control on "matching procedures", commences operation today (Friday).
A spokesman for the Homes Affairs Bureau said that the commencement notice signed by the Secretary for Home Affairs was published in the Gazette today.
A "matching procedure" is a procedure whereby one set of personal data collected in respect of 10 or more individuals for one or more purposes are compared or verified, by automated means, against another set of personal data collected for a different purpose for the purpose of taking adverse action against any of the individuals.
"As from today, a data user may only carry out a matching procedure which has been approved by the Privacy Commissioner for Personal Data, unless each individual who is the subject of that procedure has signified his agreement for the procedure to be carried out," the spokesman said.
The core provisions of the Ordinance came into effect on 20 December 1996. The commencement of section 30, however, was deferred in order to allow time for specific guidance to be issued to data users on its requirements and for them to seek approval from the Privacy Commissioner.
"In appointing 1 August 1997 as the commencement date for section 30, the Secretary for Home Affairs has accepted the Privacy Commissioner's recommendation in favour of this date taking account of the fact that reasonable time has been allowed for data users to obtain the necessary approval from the Privacy Commissioner", the spokesman said.
The spokesman added that the Privacy Commissioner had approved 12 applications for matching procedures - nine from Government departments, and three from public bodies.
Privacy Commissioner Ready for Commencement of Law Regulating "Matching Procedures"
The Privacy Commissioner for Personal Data welcomes the decision by the Secretary for Home Affairs to bring into force Section 30 of the Personal Data (Privacy) Ordinance which provides for control of "matching procedures". The Office has recently finished processing all the 19 applications for matching procedure received since applications were first invited in March 1997.
A spokesperson for the Office of the Privacy Commissioner for Personal Data (PCPD) said that among the 19 applications received, approval had been granted to 12. Most of the other seven were found not come within the definition of "matching procedure" as specified in the Ordinance.
In the approval process, the PCPD took into account a variety of factors. These included whether the carrying out of the procedure is in the public interest, the benefits that can be derived from it and the organisation's practices and procedures to ensure the accuracy of the results of the matching procedure.
The spokesperson reminded organisations wishing to carry out matching procedure that from today, before carrying out such a procedure, they should first obtain consent either from the PCPD or all the individuals whose data are to be matched. Forms to seek consent from the PCPD to carry out matching procedure can be obtained from the PCPD at Unit 2001, Office Tower, Convention Plaza, 1 Harbour Road, Wanchai.