178 / 192
Commissioner commented that it was the data user’s responsibility to properly assess
and consider whether the exemption under section 58(1)(d) and (2) could be relied
upon, i.e. that compliance with DPP3 would prejudice the purpose of section 58(1)(d).
The data user could not simply rely on the arguments made by the police.
12.54
Given the sensitive nature of most law enforcement operations, the data user may not
always be able to obtain clear proof that the prejudice test in section 58(2)(b) has been
satisfied. Nevertheless, it is still likely that the law enforcement agency may provide some
information, or confirmation of a general nature, on which the data user may
reasonably rely. The view generally taken by the Commissioner is that it is prudent for the
data user to make enquiries with the law enforcement agency on:
•
the purpose for which the personal data is to be used;
•
the reason why the personal data concerned is relevant to or necessary for the
purpose;
•
the reason why the data subject’s consent is not obtained by the agency;
•
whether the personal data can be obtained from another source; and
•
in particular, how the application of DPP3 would be likely to prejudice the purpose.
By asking for more information, the data user is put in a better position to invoke the
defence under section 58(2) in any subsequent proceedings or complaint against it for
alleged contravention of DPP3 in the disclosure of the data.
Section 58A— Protected Product and Relevant Records under Interception of
Communications and Surveillance Ordinance
12.55
Section 58A exempts from the provisions of the Ordinance any personal data which is or
is contained in any communication or material (including their copies) obtained
pursuant to the prescribed authorisations given by the panel judges or the authorising
officer for interception and covert surveillance under the Interception of
Communications and Surveillance Ordinance. In addition, any personal data system
which is used by a data user for the collection, holding, processing or use of the relevant
personal data is exempted from the provisions of the Ordinance.
Section 59 —Health
12.56
Section 59(1) exempts personal data relating to the physical or mental health of a data
subject from the provisions of DPP3, DPP6 and section 18(1)(b), if the application of such
provisions to the data would likely cause serious harm to the physical or mental health of
the data subject or any other individual. The Amendment Ordinance introduced a new
subsection (2), which broadens the scope of section 59 to also exempt from DPP3
personal data relating to the identity and location of a data subject where application
of DPP3 would likely cause serious harm to the physical or mental health of the data
subject or other individual. When properly invoked, the newly added class of personal
data will assist data users to locate the data subjects, for example, in rescue actions.