Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

145 / 192

10.66 The Commissioner is of the view that the data user should not charge the data requestor
for the costs incurred by a data user in seeking legal advice or the costs for its consultant
or staff to study the requirements under the Ordinance, as these costs are incurred for
the data user’s own protection but not strictly necessary for compliance with a data
access request.
10.67 Regarding administrative or office overheads, such are costs which by their very nature
are not directly related to or necessary for complying with a data access request, and
therefore may not be charged to the data requestor. This issue was decided by the AAB
in AAB No. 37/2009.
10.68 However, a data user may take into account the direct costs attributable to the time
spent by its staff and the actual out-of-pocket expenses for locating, retrieving and
reproducing the requested data. The data user should consider the basic skills required
to handle the data access request. Normally, clerical and administrative staff will be
considered capable of performing the tasks such as retrieving, photocopying and
redacting the data. A data user should calculate the labour cost with reference to the
staff assigned for handling the data access request. If a data user has assigned a group
of staff of the same rank for the task, the labour costs may be calculated by reference
to the average staff cost of this staff rank. Unless it has a valid justification, the data user
should not assign a professional or managerial staff to perform the tasks, otherwise the
data access request fee will be increased unnecessarily. The data user may charge for
labour cost attributable to the time spent on extracting (e.g. the costs incurred for
technical assistance in duplicating and editing a tape to remove images of other
individuals) or editing the requested data (e.g. redacting the names and identifying
particulars of other individuals), provided that the tasks are directly related to and
necessary for complying with the data access request.
10.69 The Commissioner takes the view that a data user should not include in the fee the
redaction cost of personal data exempted from compliance with a data access request,
because a data user may still choose to comply with the data access request without
invoking any exemption. Such costs are incurred for the protection of the data user’s
interests, hence not directly related to and necessary for complying with a data access
request.
10.70 The cost of photocopying the documents containing the requested data are usually
viewed as direct and necessary costs, but any photocopying costs charged to the
requestor must still not be excessive.15
10.71 A data user may sometimes choose to charge a flat-rate fee for administrative
convenience. The Commissioner is generally not opposed to the charging of a flat-rate
fee provided the fee imposed is not higher than the directly related and necessary costs
for complying with a data access request.
When Must a Data User Refuse to Comply with a Data Access Request?
15 See the Guidance Note on Proper Handling of Data Access Request and Charging of Data Access Request Fee by
Data Users , available on the Website: