Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

15 / 192

Email Addresses
2.35 An email address identifies the destination (i.e. email box) to which email messages are
delivered. An email address (comprising alphanumeric characters) can be created
easily and quickly. Very often, an individual is free to create an email address which
does not reveal his full name or contain any clue as to his identity. It is therefore difficult
for the identity of an email address holder to be properly identified solely from an email
address.
2.36 Whether an email address may constitute personal data of the email account holder
was considered in AAB No. 16/2007. In the appeal, the AAB stated that they did not
consider the email address of “huoyan_1989” to be the complainant’s name, nor was it
the complainant’s personal data.
2.37 In AAB No. 25/2008, the AAB decided that an email address in some circumstances
could be information from which the identity of an individual may be directly or
indirectly ascertained. However, the AAB did not accept that an email address
comprising the initials of the complainant was, without any further information, sufficient
to lead to the conclusion that the complainant’s identity would become reasonably
ascertainable from such an address. The AAB decided that the email address in
question was not the complainant’s personal data.
2.38 In AAB No.25/2012, the complainant sent an email enquiry to a government bureau
through the address <“Judiciary Hong Kong” and signed as
“Lau TL”. Subsequently, the bureau copied the reply email (attaching the complainant's
enquiry email) to the Judiciary for information without her consent. The AAB considered
that it was not practicable from the abbreviated name and email address (even when
read together) for the identity of the complainant to be directly or indirectly ascertained.
In any event, the fact that the complainant might have been known to the Judiciary
because of some unrelated previous events did not turn the abbreviated name and the
email address into personal data within the meaning of the Ordinance.
Biometric Data Such As DNA and Fingerprint Data
2.39 Biometric data possesses the characteristics of being both unique to the individual and
measurable.4 It includes physiological data which individuals are born with (examples
include DNA samples,5 fingerprints, 6 palm veins, hand geometry and iris, retina and
4 Description in the “Working Document on biometrics” adopted by Article 29 Data Protection Party of EU on 1 August
2003. The description was updated in the “Opinion 4/2007 on the concept of personal data” adopted by Article 29 Data
Protection Party of EU on 20 June 2007 which was followed in the “Opinion 3/2012 on development in biometric
technologies” adopted by Article 29 Data Protection Party of EU on 27 April 2012. According to these Opinions,
“biometric data” may be defined as “biological properties, behavioural aspects, physiological characteristics, living
traits or repeatable actions where those features and/or actions are both unique to that individual and measurable,
even if the patterns used in practice to technically measure them involve a certain degree of probability”.
5 See Case Note No. 2004C01 (available on the Website:
, in which the Commissioner accepted DNA as personal data.