4 / 12
4
Exercising Your Data Access Rights under the Personal Data (Privacy) Ordinance (Frequently Asked Questions and Answers) / June 2016
Q10 Must I make a data access request myself or can I authorise another individual to make a data
access request on my behalf? Can a person make a data access request on behalf of another
person who is under the age of 18 or incapable of managing his own affairs?
Apart from making a data access request yourself, you can authorise another person in writing to make a data
access request on your behalf. The data user, upon receipt of your request, may require the authorised person to
produce your identity proof and your authorisation.
Where an individual is a minor under the age of 18, a person with parental responsibility for such individual can
make a data access request on his behalf. Where an individual is incapable of managing his own affairs, a person
appointed by the court to manage his affairs can make a data access request on his behalf. Where an individual
is mentally incapacitated, a person appointed to be the guardian of him under the Mental Health Ordinance,
Cap 136, can make a data access request on his behalf. The person who makes the request on behalf of another
individual may be required by the data user to provide identity proof of the individual whose personal data is
sought and proof of his relationship with that individual, e.g. copy of relevant birth certificate or court order (as
the case may be).
Q11 Can I request the data user, when complying with my data access request, to provide me
with a copy of the requested data in the language of my choice?
You may indicate in the appropriate space provided in Part VII of the DAR Form your request for a copy of the
requested data in English, Chinese or the language in which the data is held. However, if the language in which
the data is held is not the language specified in the request, the data user may choose to provide a true copy of
the document which contains the data without providing a translation of the same.
Q12 Can I request the data user, when complying with my data access request, to provide me
with a copy of the requested data in a specified form (e.g. computer disk, microfilm etc.) ?
You may make such a request and space is provided in Part VII of the DAR Form for you to do this. However, if
it is not reasonably practicable for the data user to supply the copy in the form specified by you, it may provide
the copy in another form. For example, if the personal data requested is on an audiotape and it is not reasonably
practicable to make a transcript at your request, the data user may provide a copy of the tape to you.
Q13 What can I do if I find that my personal data provided by the data user in response to my data
access request is inaccurate?
You can request for correction of the personal data provided to you in response of a data access request, as
provided under the Ordinance. Similar to data access requests, the data user receiving a data correction request
shall respond within 40 days. If your data correction request is complied with, the data user should provide you
with a copy of the corrected data. If not, it should inform you why this has not been done.
Q14 Is there a prescribed form for making a data correction request?
No, you can simply make your data correction request in writing and provide all the supporting documentation
you may have to show that the data concerned is inaccurate, and specify how the data should be corrected.