157 / 192
(2) A data user who is unable to comply with subsection (1) in relation to a data correction
request within the period specified in that subsection shall –
(a) before the expiration of that period –
(i) by notice in writing inform the requestor that the data user is so unable and of
the reasons why the data user is so unable; and
(ii) comply with that subsection to the extent, if any, that the data user is able to
comply with that subsection; and
(b) as soon as practicable after the expiration of that period, comply or fully comply,
as the case may be, with that subsection.
11.21
Finally, insofar as compliance with a data correction request involves providing a copy
of the corrected data to the requestor, section 28(1) provides as follows:
(1) A data user shall not impose a fee for complying or refusing to comply with a data
access request or data correction request unless the imposition of the fee is expressly
permitted by this section.
11.22
While section 28(2) expressly permits imposing a fee for compliance with a data access
request, the Ordinance contains no similar provision in relation to complying with a data
correction request. It follows that a data user cannot impose any fee for compliance
with a data correction request.
11.23
When inaccurate personal data has been disclosed to a third party within twelve
months preceding the day on which the correction is made and the data user has no
reason to believe that the third party has ceased using the personal data in question, it
shall take all practicable steps to immediately supply the third party with a copy of the
corrected data giving reasons for the correction. The duty to supply the third party with
a copy of the corrected data does not arise in the situation where the disclosure of
personal data consists of the inspection of a register or other similar documents by the
third party.
2
Circumstances in Which a Data User Shall or May Refuse to Comply with a Data
Correction Request
11.24
The circumstances in which a data user shall refuse to comply with a data correction
request are provided under section 24(1) as follows:
(1) Subject to subsection (2), a data user shall refuse to comply with section 23(1) in
relation to a data correction request if the data user is not supplied with such
information as the data user may reasonably require –
(a) in order to satisfy the data user as to the identity of the requestor;
(b) where the requestor purports to be a relevant person, in order to satisfy the data
user –
(i) as to the identity of the individual in relation to whom the requestor purports to
2
Section 23(3) of the Ordinance.