139 / 192
10.44
Section 19(2) does not lay down the precise situations in which a data user may
legitimately claim to be “unable” to comply with a data access request within the
prescribed period. In previous complaints, the Commissioner accepted as valid a data
user’s claim that before complying, it needed to obtain legal advice, or clarification
from the requestor on the scope of the request. It is however still important to observe
the forty-day time limit imposed under section 19(2) to respond and give reasons for
being unable to comply with the whole or part of the request. The application of section
19(2) was considered by the AAB in its decisions below.
10.45
In AAB No. 17/2004, a data access request was made by a patient for medical records
kept by a hospital. The hospital charged for the expense of making copies of the
requested data which was paid by the requestor near the expiry of the forty-day period.
The hospital supplied the copies after receipt of the expenses but it was already some
sixty days after receipt of the request. The AAB ruled that the hospital had contravened
section 19(2) in failing to comply with the request within forty days. The AAB stated that:
…if the data user imposes a fee for complying with the [data access request], the data user
should notify the requestor of it within such time after receipt of the [data access request] as to
enable payment to be made and the requested data be supplied to the requestor within the
40 day period…Of course, if the requestor refuses to pay the fee, the data user may refuse to
comply with the request....If payment of the fee is made so near the end of the 40 day period
so that the data user is unable to supply the requested data within that time, the data user
may pray in aid of s. 19(2) and by notifying in writing the requestor of the reason for failing to
comply within time, the data user may comply with the request after the 40 day period.
10.46
In AAB No. 21/2012, the data requestor made a data access request to a government
department. The department clarified with the requestor the scope of his requested
data and thereafter informed him close to the expiry of the forty-day period about the
fee charged for supplying him with the copy of the requested data, and that the
department was unable to comply with the data access request as they had to receive
the fee before they could send him the requested data. The data requestor paid the
fee after the forty-day period had expired and the department supplied him with the
requested data the next day after receipt of the fee. The AAB found in these
circumstances that the department had complied with section 19(2) by notifying the
data requestor that they were not able to comply with the data access request within
the forty-day time period and the reasons why.
Language and Format When Responding to a Data Access Request
10.47
A copy of the personal data requested should be provided in the language specified in
the data access request or, if no such language is specified, then the language in which
the data access request has been made (which must have been either English or
Chinese).
9
However, if the requested data is held by the data user in a different
language, then the data user must provide a true copy of the document containing the
data.
10
9
Section 19(3)(c)(iii)(A) of the Ordinance.
10
Section 19(3)(c)(iii)(B) of the Ordinance.