12 / 192
2.22
This can be illustrated in the case of collection of fingerprint data by an employer for
recording attendance. While it may not be practicable for the identity of an employee
to be ascertained solely from the fingerprint data, it can be linked with other data held
by the employer, for example, the staff number assigned to each employee, which in
turn will point to the identity of a particular staff member. It will then become
practicable for the employer to ascertain the identity of the employee who swiped his
thumb image on the fingerprint scanner installed for recording attendance in order to
gain access to the office premises.
2.23
By way of contrast, it may not be practicable to determine the item of data that
belongs to a particular individual where a number of individuals’ personal data is
collected concurrently for the same purpose.
In an investigation conducted into a
theme park for collecting fingerprint data of visitors, the complainant had purchased
four “stay and play” tickets for use by him and his family members who visited the theme
park together. As the tickets were not separately personalised, it would not be
practicable for the theme park to ascertain to whom specific fingerprint data belonged
from the holders of the four tickets.
2
In that situation, the Commissioner took the view
that the condition laid down in paragraph (b) was not met.
2.24
On the other hand, where part of the personal data is anonymous so that it is not
reasonably practicable for the identity of the data subject to be ascertained from it, the
Commissioner will generally regard the condition laid down in paragraph (b) not to be
met, hence failing to satisfy the definition of personal data.
2.25
The question whether it is practicable to ascertain an individual’s identity from the data
was determined in a complaint where an individual complained about his name being
uploaded onto the web page of a discussion forum set up by the residents of an estate.
The individual alleged that the three Chinese characters of his name were used in a
poetic expression posted in the forum. The Commissioner opined that it was not
practicable to identify the individual from the data as such and decided not to
investigate the complaint. On appeal, in AAB No. 67/2005, the AAB took into account
the individual’s own interpretation of some other characters and numbers displayed in
the forum as his nickname and address, and concluded that the data, taken together,
was personal data as the forum browsers, who are mostly residents of the estate, could
easily ascertain the flat owner from the poetic expression.
3
2
See media statement released by the Commissioner on 30 July 2010 on the findings of the investigation, available on the
Website
: https://www.pcpd.org.hk/english/news_events/media_statements/press_20100730d.html .3
In
AAB No. 4/2015
, a narrow approach was adopted by the AAB in deciding that the visa status of the appellant was not
personal data, as it was not reasonably practicable for the appellant’s identity to be ascertained from the relevant
statement concerning the visa status by itself (instead of the whole document).