Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

personal data of the student. Since the scores and the examiner’s written remarks on the

marking sheets were the evaluation given by the examiner about the performance of

the student, they constituted that student’s personal data. Hence, the University should

comply with the data access request and provide the student with copies of his

examination answer books and coursework together with the examiners’ markings and

comments thereon.

Mobile Phone Numbers

2.43

Generally speaking, a mobile phone number alone may not constitute the personal

data of an individual as the phone number may be registered by a corporation, or the

actual user of the phone number may be different from the registered individual user.

However, when other identifying data, such as a name and address are also collected,

the data user may be able to link the mobile phone number with a specific individual.

The Commissioner will look at the totality of the relevant information and evidence put

before him when deciding whether a mobile phone number constitutes personal data

of the data subject in each case.

2.44

In a complaint case involving the making of direct marketing calls by an agent on

behalf of a telecommunications company, the complainant objected to receiving

persistent direct marketing calls notwithstanding his opt-out requests. The agent in this

case had managed to gather a list of mobile phone numbers for the purpose of making

direct marketing calls. According to the arrangement entered into with the

telecommunications company, the agent would send the list to the telecommunications

company to check it against the opt-out list maintained by the latter before making any

direct marketing calls. However, the agent failed to take this step. Both the

telecommunications company and the agent claimed that the complainant’s mobile

phone number was generated by random selection, which did not involve any personal

data. However, it was discovered during investigation that the telecommunications

company held other identifying particulars of the complainant. Despite the fact that the

mobile phone number was generated by random selection by the agent, the

telecommunications company was able to ascertain the identity of the complainant as

its customer from the number. The Commissioner found that personal data of the

complainant was involved and the telecommunications company had to be held liable

for the failure to comply with the complainant’s opt-out request.

Is Fabricated Information Personal Data?

2.45

Naturally, a person will disagree with any information written or recorded about him

which he regards as untrue or fabricated. Information that is untrue or fabricated is not

personal data under the Ordinance as it cannot be regarded as data relating directly or

indirectly to an individual. The AAB has expounded this view in AAB No. 29/2001 which

See Investigation Report No. R08-10578, available on the Website:

See Investigation Report No. R10-4422, available on the Website: