Date: 6 February 2023
Privacy Commissioner’s Office’s Response to the Incident relating to the Film To My Nineteen-Year-Old Self
The Office of the Privacy Commissioner for Personal Data (PCPD) noted the media reports on the personal data privacy issues relating to the film To My Nineteen-Year-Old Self. The PCPD is concerned about the incident. In order to protect the personal data privacy of the relevant students (as data subjects), the PCPD has taken the initiative to contact the school concerned to ascertain the details of the incident.
Generally speaking, everyone’s personal data privacy should be protected and respected, regardless of age. If any person or organisation intends to identify an individual or compile information about a specific individual through shooting a film, this may constitute collection of the personal data of the data subject, and the relevant individual or organisation (as data user) must comply with the requirements of the Personal Data (Privacy) Ordinance and relevant Data Protection Principles (DPPs) when it collects, holds, processes or uses personal data.
With regard to the use of personal data, DPP3 provides that personal data shall not, without the voluntary and explicit consent of the data subject, be used (including the disclosure and transfer of relevant data) for a new purpose other than the purpose for which the data was to be used at the time of the collection of the data or a directly related purpose.
As of today (6 February), the PCPD has not received any complaints or enquiries from the public relating to the incident. Any person who suspects that his or her personal data privacy has been infringed and can provide prima facie evidence (including details about misuse of the personal data) may lodge a complaint with the PCPD.
－End－