132 / 192
especially a request under section 18(1)(b).
10.12
Similarly, the Commissioner has received complaints about failures to comply with data
access requests that are worded as follows: “give me in writing the reason for (my
dismissal, your rejecting my application, etc.)”. In this connection, it is important to
remember that the term “data” is defined in section 2(1) as the representation of
information in a document. Hence, unless the reason or explanation sought already
exists in a document (which in most cases means in writing), the Commissioner takes the
view that the data user has no obligation, upon receiving such a request, to document
the reason or explanation being sought, i.e. to create data for the sake of complying
with the data access request.
Who May Make a Data Access Request?
10.13
Section 18(1) provides that a data access request may be made by “an individual, or a
relevant person on behalf of an individual”.
“Relevant person” is defined in section 2(1)
and its meaning is further expanded in section 17A of the Ordinance for the purpose of
making a data access or correction request.
10.14
Section 2(1) provides as follows:
“relevant person”, in relation to an individual (howsoever the individual is described),
means –
(a) where the individual is a minor, a person who has parental responsibility for the minor;
(b) where the individual is incapable of managing his own affairs, a person who has been
appointed by a Court to manage those affairs;
(c) where the individual is mentally incapacitated within the meaning of section 2 of the
Mental Health Ordinance (Cap. 136) –
(i) a person appointed under section 44A, 59O or 59Q of that Ordinance to be the
guardian of that individual; or
(ii) if the guardianship of that individual is vested in, or the functions of the appointed
guardian are to be performed by, the Director of Social Welfare or any other
person under section 44B(2A) or (2B) or 59T(1) or (2) of that Ordinance, the Director
of Social Welfare or that other person;
10.15
Section 17A provides as follows:
Without limiting the definition of relevant person in section 2(1), in this Part –
“relevant person”, in relation to an individual, also includes a person authorised in writing by
the individual to make, on behalf of the individual –
(a) a data access request; or
(b) a data correction request.
10.16
When a data user receives a data access request made by a “relevant person”, it
should ascertain the capacity of the requestor in order to satisfy itself that the requestor
is a person specified under sections 2(1) or 17A of the Ordinance. The data user may
request information as to the requestor’s capacity (such as written authorisation signed