177 / 192
12.49
Deputy Judge Seagroatt, in the case of Chan Chuen Ping, confirmed that the provisions
of the Ordinance did not restrict the Court’s power in making an order for pre-action
discovery under the High Court Ordinance, which provided a basis for the requestor to
compel disclosure of the data held by government departments to facilitate the
administration of justice by providing to individuals information needed to advance a
potential remedy or possible cause of action.
5
12.50
Whether a conduct would amount to “seriously improper conduct” depends on the
facts of each case. A conduct which does not itself appear to be seriously improper in
nature, e.g. serious indebtedness, may be seriously improper in the circumstances of the
data subject. In AAB No. 5/2006, the AAB considered that the serious indebtedness of an
officer of a law enforcement agency was contrary to the disciplinary guidelines of the
law enforcement agency and amounted to seriously improper conduct.
6
12.51
Even if the data is held or to be used for any of the purposes specified in paragraphs (a)
to (g) of section 58(1), the exemption does not apply unless the data users can also
establish that the application of DPP6 and section 18(1)(b), and DPP3, as the case may
be, would likely prejudice the said purposes. Whether or not the specified purposes
would be likely prejudiced does not depend on the subjective view of the data user. The
standard is an objective one.
7
The more enquiries and evidence the data users
reasonably make and obtain to establish the prejudice requirement, the more likely that
they may satisfy this objective requirement.
12.52
There is usually little or no doubt that the provision by a data user of any personal data
requested by a law enforcement agency would be used in the discharge of the
agency’s functions (e.g. the prevention or detection of crime, the assessment or
collection of any tax or duty, etc.), the matter of which would fall within section 58(1).
However, simply because a law enforcement agency requests the personal data does
not necessarily mean that a data user can provide the data as requested without
complying with DPP3. The question is whether non-provision of the data would indeed
be so serious as to be likely to prejudice any such matters, as required by section
58(2)(b).
12.53
In a complaint case, a bank disclosed a data subject’s personal data to the police after
receiving a letter from the police requesting such disclosure for the purposes of a
disciplinary investigation. The police argued that the request was exempt from DPP3
based on section 58(1)(d) and (2). The bank relied on the police’s statement and
disclosed the personal data to the police without first obtaining the complainant’s
consent pursuant to DPP3. The Commissioner found that the bank had breached DPP3,
as it could not reasonably believe that providing the personal data to the police without
complying with DPP3 would likely prejudice the purpose of section 58(1)(d). The
5
In
Chan Yim Wah Wallace v. New World First Ferry Services Limited
[HCPI 820/2013], the Court observed that the broader
ambit of the new section 60B will render largely otiose the narrow scope of section 58(1) and (2). See paragraphs 12.78
to 12.81 for detailed discussions.
6
Similar examples can also be found in
AAB No. 12/2014 and AAB No. 26/2014
.
7
AAB No. 5/2006
.