141 / 192
Data Access, if no criminal conviction is found, the applicant will be notified verbally of
the result. If a criminal conviction is found, the applicant will be given a summary of the
conviction and charged a processing fee.
10.50
In AAB No. 1/2008, the complaint raised the question of whether or not, in response to a
data access request, the police would have to confirm in writing if no criminal
conviction records were found, rather than simply providing such confirmation orally.
The police were concerned about possible abuses of the data if it was supplied in
writing.
10.51
The concern has been alleviated after the introduction of a new provision, i.e. section
19(1A) by the Amendment Ordinance which specifically deals with the procedure for
complying with a data access request by the police. Section 19(1A) provides as follows:
(1A)Despite subsection (1)(b), if –
a. a data access request is made to the Hong Kong Police Force as to whether it
holds any record of criminal conviction of an individual; and
b. it does not hold such record,
it must comply with the request by informing the requestor orally, within 40 days after
receiving the request, that it does not hold such record.
10.52
The police can now rely on section 19(1A) to comply with a data access request for
record of criminal conviction by giving verbal information to the data requestor if it does
not hold such record.
Requested Data Comprising Personal Data of Another Individual
10.53
Data users should take note of the requirements under section 20(1)(b) and (2) when the
requested data contains the personal data of individual(s) other than the data subject.
10.54
Section 20(1)(b) provides as follows:
(1) A data user shall refuse to comply with a data access request –
…..
(b) subject to subsection (2), if the data user cannot comply with the request without
disclosing personal data of which any other individual is the data subject unless the
data user is satisfied that the other individual has consented to the disclosure of the
data to the requestor; …
10.55
It should be noted that when applying the definition of “personal data” under section
2(1), it is possible for an item of information to constitute simultaneously the personal
data of two or more individuals. Take, for example, a statement contained in a letter
which reads, “John Doe is a distant cousin of Mary Doe”. Obviously, the statement
constitutes the personal data of John Doe and, at the same time, that of Mary Doe, and
it is impossible to separate one from the other. In other words, compliance with a data
access request from one of the individuals may involve the disclosure of the personal
data of the other.