155 / 192
(a) …
(b) where the requestor purports to be a relevant person, in order to satisfy the data
user –
(i) as to the identity of the individual in relation to whom the requestor purports to
be such a person; and
(ii) that the requestor is such a person in relation to that individual.
11.9
As in the case of a data access request, although section 24(3)(a) allows a data user to
refuse to comply with a data correction request not made “in writing in the Chinese or
English language”, the fact that this condition is not satisfied in the case of a data
correction request does not, strictly speaking, prevent it from being a data correction
request, albeit one that may be legitimately refused. A data user refusing the request on
these grounds is still required to comply with the requirements applicable to such refusal,
as will be discussed in paragraphs 11.34 to 11.42 below.
11.10
Section 22(1) does not specify that a data correction request has to be in writing. The
question as to whether it can be made verbally was examined in AAB No. 12/2008 which
concerned the accuracy of the personal records kept by an employer about an
employee. The AAB took the view that “…we disagree that a data correction request
can be made verbally for the simple reason that it would be difficult to verify not only
whether a request has been made but also the requested correction”. Reference is also
made to section 24(3)(a) which provides grounds for the data user to refuse to comply
with a data correction request if it is “not written in the Chinese or English language”.
11.11
Similarly, neither section 22(1) nor any other provision in the Ordinance provides for any
particular way in which a data correction request must be framed. However, since a
data correction request must be preceded by a data access request, by the time the
data user receives the data correction request, he should be aware of its relevance.
11.12
In this regard, after complying with a data access request, a data user should assess
whether any subsequent correspondence from the requestor would constitute a data
correction request. If a requestor replies to the data user suggesting any inaccuracy in
the copy of his personal data and requesting correction of such data, the
correspondence could constitute a data correction request and it is prudent for the
data user to observe the requirements under Part 5 of the Ordinance.
Compliance with a Data Correction Request
11.13
Section 23(1) of the Ordinance, which deals with compliance with a data correction
request, provides as follows:
(1) Subject to subsection (2) and section 24, a data user who is satisfied that personal data
to which a data correction request relates is inaccurate shall, not later than 40 days after
receiving the request –
(a) make the necessary correction to the data;
(b) supply the requestor with a copy of the data as so corrected; and
(c) subject to subsection (3), if –