156 / 192
(i) the data has been disclosed to a third party during the 12 months immediately
preceding the day on which the correction is made; and
(ii) the data user has no reason to believe that the third party has ceased using
the data for the purpose (including any directly related purpose) for which the
data was disclosed to the third party,
take all practicable steps to supply the third party with a copy of the data as so corrected
accompanied by a notice in writing stating the reasons for the correction.
11.14
The first point to note is that a data user is obliged to comply with a data correction
request only if it is “satisfied that the personal data to which the data correction request
relates is inaccurate”. For instance, if the data user is satisfied that the HKID number was
inaccurately recorded, it should make the necessary correction. If the data in question
was provided by a third party instead of being directly collected from the data subject,
the data user may need to consult the third party on the accuracy of such data.
11.15
Where the data user is not satisfied that the data was inaccurate, he may refuse to
comply with the data correction request in accordance with section 24(3)(b), to be
discussed in paragraphs 11.24 to 11.33 below.
11.16
Another point to note is that “correction”, in relation to personal data, is defined in
section 2(1) as meaning “rectification, erasure or completion”. How this has been
applied by the Commissioner is illustrated in a complaint case, in which the complainant
made a data correction request to a government bureau in relation to notes kept by
the bureau. The notes, being the record of an interview with a third person, contained
certain information about the complainant, which later proved to be inaccurate. The
complainant therefore requested the deletion of his data contained in the notes.
11.17
Instead of deleting the data in question, the government bureau entered a note in the
same file clearly pointing out the inaccuracy of the information. A copy of the note was
provided to the complainant. Also, a marker was added to the relevant file to refer the
reader to the note.
11.18
Although the complainant was dissatisfied with the manner in which his request had
been complied with, the Commissioner took the view that what the government bureau
had done was in effect “rectification” or “completion” of the relevant data, and as such,
amounted to adequate compliance with section 23(1). The manner of compliance was
regarded as more appropriate than simply deleting the data, as suggested by the
complainant, so as to preserve a true record of what the third person had actually said
in the interview, despite the inaccuracy of the information.
11.19
Except where there are valid grounds for refusing to comply with a data correction
request under section 24, a data user is required to make the necessary correction and
supply a copy of the corrected data to the requestor within forty calendar days after
receiving a data correction request.
11.20
If the data user is unable to comply with the data correction request within the specified
forty days, it must notify the requestor accordingly and comply with the request as soon
as practicable as provided under section 23(2):