Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

16 / 192

facial images) and behavioural data which are characteristics developed by an
individual after birth (examples include handwriting pattern, typing rhythm, gait and
voice pattern). 7 They are sensitive in nature, considering that they are not artificial
information which can be rendered obsolete when the individual finds necessary. For
instance, an individual whose wallet is stolen may apply for cancellation or renewal of a
credit card immediately, but in no circumstances can an individual be disconnected
from his unique biometric data.
2.40 While it may not be reasonably practicable for a lay person to ascertain the identity of
an individual by merely looking at the individual’s fingerprint images or their numeric
representations, when the biometric data is linked with personal data in another
database, a particular individual can be identified. In one complaint, a company
installed a fingerprint recognition system to record attendance of its staff. Instead of
collecting the fingerprints of the staff, the system collected certain features of the
fingerprints and converted the features into numeric representations for record purposes.
The Commissioner’s view was that although the system adopted by the company did
not collect the whole image of the fingerprint, the system could ascertain the identity of
the staff by linking the features of the fingerprints with other identifying particulars held
by it and so the data collected was personal data as defined by the Ordinance.8
Examination Scripts
2.41 Students’ answers to examination questions generally do not relate to the students and
hence are not the students’ personal data. If an examination script was marked with the
examiner’s comments or an evaluation of the student’s answers, those comments and
evaluation would be the student’s personal data. In AAB No.7/2007, the AAB held the
view that in general an answer given by a candidate in an examination did not amount
to personal data of the candidate, but “if an examination script of the appellant was
marked with the examiner’s comments or evaluation of the appellant’s answers, that
examination script would be a document containing personal data of the appellant”.
2.42 The rationale of the above AAB decision was followed by the Commissioner in handling
a complaint lodged by a student who made a data access request to a University for
copies of his examination answer books and coursework. The University refused to
comply with the data access request on the grounds that the requested documents
were not the student’s personal data as the identity of the student was never an item of
information that affected their comments and marking. The Commissioner took the view
that evaluation of the performance of a student in an examination constituted the
6 See Case Note No. 2005C12 (available on the Website:
, in which the Commissioner accepted fingerprints as personal data.
7 See the Guidance on Collection and Use of Biometric Data, available on the Website:
8 See Investigation Report No. R09-7884, available on the Website: