133 / 192
by the data subject), evidence showing the requestor’s parental relationship with the
data subject who is a minor, or evidence showing that the requestor is the lawful
guardian or person appointed by the Court to manage the affairs of the data subject
who is incapable of managing his affairs. If a data user cannot reasonably establish the
relationship between the requestor and the data subject, the data user must refuse to
comply with the data access request.
10.17
Section 18(1) provides that a relevant person may make a data access request on
behalf of a data subject. The provisions of the Ordinance, however, give no indication,
of the kind of situation in which a data access request made by a relevant person is to
be regarded as being so made “on behalf of” the individual. Doubt may arise as to
whether a data access request is properly made by one of the parents as a relevant
person on behalf of a minor in the following two situations: first, where the parent is
physically separated from the minor, so that one may suspect the data access request is
in fact made by the parent for his own purposes, so as to enable himself to locate the
minor or the other parent of the minor rather than on behalf of the minor; secondly,
where the minor could well be disinclined, if asked, to have his data released to the
parent.
10.18
For example, a parent who has been denied physical access to his child by the Court or
the custodian parent may try to lodge a data access request under the Ordinance with
a social welfare organisation or the child’s school, seeking to obtain the personal data
of the child, on the basis that he is the
“
relevant person
”
of that child. However, from the
subject matter raised in the request (e.g. a request for information on the whereabouts
of the child which is obviously known to the child in question) it may be argued that the
parent requesting the data is making the data access request for his own benefit, rather
than in the child’s interest. In situations like these, the Commissioner will be inclined to
take the view that the request is not made “on behalf of” the child and does not
therefore satisfy the requirements under section 18(1) of the Ordinance.
How to Make a Data Access Request?
10.19
The Ordinance does not prescribe any particular form or mode by which a data access
request may be made. However, under sections 20(3)(a) and (e), if a data access
request is not made “in writing in the Chinese or English language” or the request is not
made in the form prescribed by the Commissioner, these may constitute valid grounds
on which the request may be refused. Even so, the data user is still bound to comply with
the requirements applicable to such a refusal, as will be discussed in paragraphs 10.78 to
10.83 below.
10.20
Cases handled by the Commissioner suggested that the absence of any prescribed
form for a data access request often caused confusion. In particular, a data user
receiving such a request could easily be unaware of it being a data access request,
hence failing its obligation to respond to it in strict compliance with the Ordinance. This
has a significant impact on data users who have regular dealings with individuals. Even if
a request is not meant to be made pursuant to the Ordinance (for example, a request
made to a government department pursuant to the Code of Access to Information), the
requested information may happen to contain the requestor’s personal data.