148 / 192
request;
(d) subject to subsection (4), any other data user controls the use of the data in such a
way as to prohibit the first-mentioned data user from complying (whether in whole
or in part) with the request;
(e) the form in which the request shall be made has been specified under section 67
and the request is not made in that form;
(ea)the data user is entitled under this or any other Ordinance not to comply with the
request; or
(f) in any other case, compliance with the request may for the time being be refused
under this Ordinance, whether by virtue of an exemption under Part 8 or otherwise.
10.79
Section 20(3)(a) and (e) have already been discussed above.
19
Of the various other
grounds of refusal provided for in section 20(3), the one under paragraph (f) is the
broadest. In particular, Part 8 of the Ordinance provides for many situations in which
personal data is exempt from access by the data subject (which will be discussed in
Chapter 12). When a data user is uncertain whether any of the exemption provisions
apply to a particular case, the prudent practice is to seek independent legal advice
before relying upon the exemption to not comply with a data access request. The
Commissioner takes the view that refusal of a data access request on invalid grounds
(even if the data user subjectively believed them to be valid) technically constitutes
contravention of section 19(1) by the data user. The burden of proof lies on the data
user to properly invoke the exemption.
10.80
Of the remaining provisions in section 20(3), paragraph (d) also deserves mention. In fact,
this paragraph needs to be read in conjunction with sections 21(1) and 18(4), which
provide as follows:
Section 21(1)
–
(1) Subject to subsection (2), a data user who pursuant to section 20 refuses to comply with
a data access request shall, as soon as practicable but, in any case, not later than 40
days after receiving the request, by notice in writing inform the requestor –
(a) of the refusal;
(b) subject to subsection (2), of the reasons for the refusal; and
(c) where section 20(3)(d) is applicable, of the name and address of the other data
user concerned.
Section 18(4)
–
(4) A data user who, in relation to personal data –
(a) does not hold the data; but
(b) controls the use of the data in such a way as to prohibit the data user who does
hold the data from complying (whether in whole or in part) with a data access
request which relates to the data,
19
See paragraphs 10.19 to 10.24.