131 / 192
10.7
Section 18(1) is so drafted that neither the word “and” nor “or” appear between
paragraphs (a) and (b). Taking the literal meaning that it bears, and in applying the rule
of literal interpretation, paragraphs (a) and (b) could be construed to be two distinct
categories of request. The Commissioner adopts the view that the two paragraphs are
not conjunctive and should be construed to cover two separate categories of request
the choice between which a requestor, in making a data access request, is entitled to
make. In other words, a data access request may consist of only a request under
paragraph (a), or only a request under paragraph (b), or both. Section 18(2) also
provides that if a data access request is made by the same requestor under both
paragraphs (a) and (b), they shall be treated as a single request.
10.8
When a data access request is made under section 18(1)(a), section 18(3) of the
Ordinance provides that the data user may, in the absence of evidence to the contrary,
treat the data access request as one made under both section 18(1)(a) and (b). In
addition to simply responding to the request made under section 18(1)(a), the data user
can also choose to supply a copy of the personal data to the requestor pursuant to
section 18(1)(b) of the Ordinance.
10.9
Prior to the Amendment Ordinance, it was unclear whether or not a data user could
ignore a request made only under section 18(1)(b) if the data user did not hold the
personal data requested. The Amendment Ordinance clarified this situation by
amending section 19(1) to expressly require data users to inform a data requestor if it
does not hold any of the requested data within forty days of receiving such a request.
4
10.10
It should also be noted that reading paragraph (a) of section 18(1) alone, it is not clear
whether “personal data” as used therein means that a requestor can ask for
confirmation on whether or not a data user holds any of his personal data in general, or
whether the requestor must identify a specific item of personal data in relation to which
he is seeking confirmation. The Commissioner takes the view that the meaning of that
term includes both. In other words, when making a data access request under
paragraph (a), the requestor may choose to ask a data user the general question of
“do you hold any of my personal data in the personnel file?” or, alternatively, the more
specific question of “do you hold my appraisal report dated xxx?” (the appraisal report
being a specific document that contains the requestor’s personal data).
10.11
It should also be noted that no reference is made in paragraph (a) or (b) of section 18(1)
to a description or list of data (if any) being held. Accordingly, where a data access
request is phrased in terms such as “give me a list of all my data held by you”, the
Commissioner is inclined to take the view that this does not strictly constitute a data
access request within the meaning of section 18(1) obligating compliance by the data
user under the Ordinance. It has been confirmed in the case of AAB No. 24/2001
(discussed in paragraph 10.37 below) that a data subject has no right to demand an
exhaustive list of all his data held by a data user. A data user, however, may sometimes
choose to provide such a list to facilitate its handling of a data access request,
4
The issue of whether a data user, in compliance with a data access request made under section 18(1)(a) of the
Ordinance, may inform the requestor verbally that the data user does not hold the requested data, formed the subject
matter of
AAB No. 10/2010
. The AAB referred the said question of law to the Court of Appeal for determination by way
of case stated. The Court of Appeal, in
CACV 229/2011
, answered the question in the affirmative having considered the
original provision of section 19(1) prior to the Amendment Ordinance, the purpose of the Ordinance and public policy,
as well as the proposed amendments to section 19(1). See also paragraphs 10.29 to 10.31 for discussion on section 19(1).