188 / 192
12.96
Section 62 exempts from application of DPP3 when the following conditions are satisfied:
(a) the data is to be used for preparing statistics or carrying out research;
(b) the data is not to be used for any other purpose; and
(c) the resulting statistics or results of the research are not made available in a form which
identifies the data subjects or any of them.
12.97
In order to satisfy this exemption provision, the data user must be careful to ensure these
requirements are met, in particular, the requirement in (c) above, i.e. that the resulting
statistics or results of the research do not expressly reveal the identities of the data
subjects, or is compiled in such a way that makes it reasonably practicable for their
identities to be ascertained.
12.98
Very few complaints have been brought before the Commissioner on the application of
this exemption. Insofar as the requirements mentioned in this exemption are met, the raw
data may continue to be retained by the data user for so long as this exemption applies.
The Code of Practice on Consumer Credit Data has specifically provided for the retention
of data by the credit reference agency
17
to be used for purposes exempted under
section 62.
Section 63 — Exemption from Section 18(1)(a)
12.99
This exemption supplements the application of sections 57 and 58 when invoked by a
data user to refuse to comply with a data access request made under section 18(1)(b).
For the scope of application of sections 57 and 58, readers are referred to paragraphs
12.26 to 12.54 above.
12.100
The statutory duty to inform the data subject of whether the data user holds his personal
data under section 18(1)(a) (in response to a data access request) is exempt under
section 63 which provides as follows:
Where a data access request relates to personal data which is or, if the data existed, would
be exempt from section 18(1)(b) by virtue of section 57 or 58, then the data is also exempt
from section 18(1)(a) if the interest protected by that exemption would be likely to be
prejudiced by the disclosure of the existence or non-existence of that data.
12.101
There may be situations where, for reasons of security and/or the prevention or
detection of crime, etc. mentioned in sections 57 and 58, the mere disclosure of the fact
that the data does exist or not, would be likely to prejudice the interest protected by this
exemption. The classic example is the one quoted in paragraph 12.29 where the
disclosure of the data pursuant to section 18(1)(a) might put the lives and well-being of
the informant in jeopardy.
17
See Clause 3.7 of the Code, available on the Website:
https://www.pcpd.org.hk/english/data_privacy_law/code_of_practices/files/CCDCode_2013_e.pdf