by Robin McLeish, Deputy Privacy Commissioner for Personal Data
Introduction
The Personal Data (Privacy) Ordinance came into force on 20 December 1996. At the core of the Ordinance are six data protection principles. These principles encompass a set of fair information practices that have achieved international acceptance and are found in one form or another in personal data privacy laws around the world. This article gives an introduction to the data protection principles and what they mean for private sector organisations in general and journalists in particular.
The Data Protection Principles
The central pillar of the fair information practices embodied in the data protection principles is the notion that when individuals provide information about themselves they do so for particular purposes which should be adhered to. Accordingly, the data protection principles require that personal information should only be used for the purposes for which it was collected or ones directly related to them. To assist in giving effect to this requirement, the principles also require that individuals should be informed of the purposes for collecting their personal information when it is collected directly from them and that personal information should be kept for no longer than is necessary to fulfil those purposes.
In addition, the data protection principles require that personal information should be collected by means that are lawful and fair, its accuracy should be ensured and it should be held and transmitted under appropriate conditions of security. Lastly, they give individuals the right to access and correct personal information relating to themselves.
The Key Message
The key message to be drawn from the data protection principles is that persons who collect, use, hold and process personal information need to develop a special sensitivity towards such information. Personal information must not be treated as being simply a commercial commodity or just a tool of your trade. Individuals have privacy interests in their personal information and those interests must be respected and protected.
Concerns about the Impact of the Ordinance
Very few people would deny that the requirements of the data protection principles represent basic common-sense notions of fairness. Nevertheless, there are concerns about the impact of implementing them. In the private sector, such concerns revolve around the costs of implementation and restrictions on the ability of companies to maximise the value of their information resources.
Journalists, on the other hand, are concerned that the privacy argument will be used to restrict the free flow of information. They may also be concerned that the use of access rights and the powers of the Privacy Commissioner for Personal Data, the regulatory authority established by the Ordinance, may be used to interfere with their activities.
Private Sector Concerns
It is certainly true that implementation of the data protection principles requires changes to be made. Changes always have a price tag. There is the cost of revamping current systems: for example, to include statements of the purpose of collecting personal information in customer forms and to ensure the erasure of personal information when the original purposes of collection have been fulfilled. There is also the cost of devoting human resources to co-ordinating and drawing up procedures for compliance with the Ordinance. But the price of compliance must be viewed against the benefits.
Successful implementation of the data protection principles sends a positive message to customers and employees. It says we are about you as invididuals. This is good for customer and employee relations.
Implementation of the data protection principles is also an opportunity to get to grips with information collection, holding and processing systems that may no longer be fully under control. Are you sure that you are doing your best to collect only the information you need and to ensure accuracy? Improvements in these areas should bring operational efficiency and planning gains.
At a higher level, comfort should be taken from the fact that the implementation of the Personal Data (Privacy) Ordinance means that Hong Kong comes up to the international standard that other places with such laws wish to see. As a result, there should be no interference by those other places in the free flow of personal information to Hong Kong on which trade, particularly in the service industries, crucially depends.