151 / 192
...
(3) The particulars required by subsection (2) to be entered by a data user in the log book
shall be so entered –
(a) in the case of particulars referred to in paragraph (a) of that subsection, on or
before the notice under section 21(1) is served in respect of the refusal to which
those particulars relate; . . .
10.91
In this connection, it should be noted that “log book” is not defined in the Ordinance.
One may therefore question whether, besides a bound book which is a generally
accepted form of a “log book”, records kept in different forms, e.g. by electronic means,
would also suffice as constituting a “log book” for the purposes of section 27(1). The
liberal interpretation of “log book” would include one existing in electronic format so
long as the procedures prescribed under section 27(1) are followed and the
Commissioner is not hindered from exercising his powers under section 27(4) to inspect
and copy the log book at any reasonable time.
10.92
The question also arises as to whether section 27 actually requires every data user to
have a blank log book, even before it refuses any data access request, i.e. before there
is anything to record. The Commissioner takes the view that this would not be necessary
so long as the refusal to comply with a data access request is properly recorded in
accordance with section 27.
Proper Exercise of the Right To Access Personal Data
10.93
It should be emphasised that the data access right conferred upon a data subject
under section 18 of the Ordinance should not be abused nor should it be exercised to
substitute or replace other proper channels for discovery of documents readily available
to the data subject. The Commissioner is vigilant in examining all the relevant
circumstances of cases in ensuring that such right is not abused so as to become an
instrument of harassment against the party to whom the request is made, the legislative
intent of the Ordinance considered.
10.94
The use of a data access request shall not supplement the rights of discovery in legal
proceedings. In the case of Wu Kit Ping, it was held that the right of an individual to
obtain data is limited to that individual’s personal data and the entitlement of a data
subject is to confined to knowing what personal data the data user holds. The learned
judge took the view that the data subject’s entitlement is to a copy of the data, not to
“see every document which refers to a data subject”. Furthermore, “it is not the purpose
of the Ordinance to supplement rights of discovery in legal proceedings, and not to add
any wider action for discovery for the purpose of discovering the identity of a
wrongdoer either” under the Norwich Pharmaceutical discovery principle. The purpose
of the Ordinance “is not to enable a data subject to locate information for other
purposes, such as litigation”.
10.95
In a complaint lodged by a dismissed employee against his former employer, the
employee claimed that the employer failed to comply with a series of his data access
requests for various internal minutes, letters and records on incidents which concerned
him by omitting or deleting data which he believed to belong to him. After examining