171 / 192
12.23
The condition (ii) mentioned above is in line with the completion of the relevant process
mentioned in section 55(2)(a)(i)(A) whereby personal data is considered for the purpose
of determining the suitability, eligibility or qualifications of the data subject for
employment or appointment to office.
12.24
It is worth noting that after the candidate has been informed in writing of the result of his
job application, the data user could no longer rely on this exemption to refuse the
compliance of a data access request in respect of references given on, or after the
coming into effect of, section 56. However, in complying with the data access request
so made, the data user shall, pursuant to section 20(1)(b) and 20(2), give copies of the
requested data only after the omission or editing out of the identifying particulars of any
other individuals (e.g. the referees) unless the data user is satisfied that they have
consented to the disclosure of their personal data to the requestor.
12.25
Section 56 applies to a reference given by an individual other than in the ordinary
course of his occupation. It does not therefore apply to the situation where a reference
is furnished by a person, such as the personnel officer of a corporation whose duties
include responding to reference checks made by prospective employers of its ex-
employees. In AAB No.26/2013 which concerned the supply of a reference by an
assistant manager of the complainant’s former employer to her prospective employer,
the Commissioner took the view that section 56 was not applicable because the
reference was not given by an individual other than in the ordinary course of his
occupation. The decision was upheld by the AAB.
Section 57 — Security, etc. in Respect of Hong Kong
12.26
Section 57 exempts from application the provisions of DPP6, section 18(1)(b) and DPP3
to personal data held or used for the following purposes:
(1) Personal data held by or on behalf of the Government for the purposes of
safeguarding security, defence or international relations in respect of Hong Kong is
exempt from the provisions of data protection principle 6 and section 18(1)(b) where
the application of those provisions to the data would be likely to prejudice any of the
matters referred to in this subsection.
(2) Personal data is exempt from the provisions of data protection principle 3 in any case in
which –
(a) the use of the data is for any of the purposes referred to in subsection (1) (and
whether or not the data is held for any of those purposes); and
(b) the application of those provisions in relation to such use would be likely to
prejudice any of the matters referred to in that subsection, . . .
12.27
In determining whether the exemption under section 57(1) or (2) is applicable to a
particular case, the Commissioner will take into account any certificate signed by the
Chief Executive or Chief Secretary for Administration who are empowered under section
57(3) and (4) to certify that exemption is or was required or that personal data is or has
been used for any purpose referred to in subsection (1). They may also in the certificate