173 / 192
(e) the prevention or preclusion of significant financial loss arising from –
(i) any imprudent business practices or activities of persons; or
(ii) unlawful or seriously improper conduct, or dishonesty or malpractice, by
persons;
(f) ascertaining whether the character or activities of the data subject are likely to
have a significantly adverse impact on anything –
(i) to which the discharge of statutory functions by the data user relates; or
(ii) which relates to the discharge of functions to which this paragraph applies by
virtue of subsection (3); or
(g) discharging functions to which this paragraph applies by virtue of subsection (3); . . .
12.32
On the whole, section 58(1) and (2) provide respectively for exemption from DPP6 and
section 18(1)(b), as well as DPP3. In particular, under section 58(1), exemption from DPP6
and section 18(1)(b) is available for any personal data that satisfies the following criteria:
• the data is held for any of the specified purposes (section 58(1)(a) to (g)); and
• the application of DPP6 and section 18(1)(b) to the data would either be likely to
prejudice any of those purposes, or to identify directly or indirectly the person who is
the source of the data (section 58(1)(i) and (ii)).
12.33
In contrast, exemption from DPP3 is available under section 58(2) for any personal data
that satisfies the following criteria:
• the use of the data is for any of the purposes specified in section 58(1) (section
58(2)(a)); and
• the application of DPP3 to such use would be likely to prejudice any of those
purposes (section 58(2)(b)).
12.34
In addition, section 58(2) also creates a defence for a data user who shows, in any
proceedings relating to the use of data contrary to DPP3, that he “had reasonable grounds
for believing that failure to so use the data would have been likely to prejudice” any of the
matters mentioned in section 58(1)(a) to (g).
12.35
From the above, it can be seen that the purposes specified in paragraphs (a) to (g) of
section 58(1) are crucial in determining the operation of section 58. The Commissioner
takes the view that data users seeking to rely on section 58 have to obtain sufficient
evidence to establish that the data is held or used for the specified purposes. Mere or
general assertion that the data is held or used for the specified purposes will not be
sufficient.
2
12.36
Among the purposes set out in section 58(1), those specified in paragraphs (a), (b) and (c),
namely, “the prevention or detection of crime”, “the apprehension, prosecution or
detention of offenders” and “the assessment or collection of any tax or duty”, appear to
be relatively straightforward. Section 58(6) defines “crime” as an offence under the laws of
2
AAB No. 64/2005
.