189 / 192
12.102
The data user would still be obliged to comply with section 18(1)(a)
18
upon receipt of a
data access request so made even though exemptions under sections 57 and 58 apply.
Section 63 is thus viewed as important in providing the data user with a statutory basis
insofar as the prejudice test therein laid down is satisfied to refuse to comply with a data
access request made under section 18(1)(a), giving a more complete and meaningful
application to sections 57 and 58.
Section 63A—Human Embryos, etc.
12.103
This exemption provides that if personal data consists of information showing that an
identifiable individual was, or may have been, born in consequence of a medical,
surgical, obstetric or other procedure assisting or otherwise bringing about human
reproduction by artificial means, such personal data is exempt from DPP6 and section
18(1)(b). The data is also exempt from section 18(1)(a) if the interest protected by that
exemption would be likely to be prejudiced by the disclosure of the existence or non-
existence of the data.
Section 63B —Due Diligence Exercise
12.104
This new exemption added under the Amendment Ordinance seeks to address the
practical needs of businesses to disclose or transfer information which may contain
personal data in an intended merger, acquisition or transfer of businesses for the
purpose of conducting a due diligence exercise by the proposed transferee. Such use
of personal data may not fall within the original or directly related purpose of collection
and the transfer of personal data in the absence of the prescribed consent of the data
subjects may contravene DPP3. However, obtaining prescribed consent prior to the
transfer will pose a hurdle to merger or acquisition activities which are very often time
sensitive. Moreover, there may be a genuine need to keep the transaction confidential
at the due diligence stage.
12.105
Data users who seek to invoke this exemption should be careful about the limited scope
of its application by paying particular attention to the definition of “due diligence
exercise”, the nature of the proposed business transaction, the amount of personal data
to be disclosed or transferred by the data users and the duty of the transferee to return
the personal data after completion of the due diligence exercise.
12.106
“Due diligence exercise” is defined under section 63B(6) to mean:
in relation to a proposed business transaction, the examination of the subject matter of the
transaction to enable a party to decide whether to proceed with the transaction
12.107
The scope of the exception is provided under section 63B(1) as follows:
(1) Personal data transferred or disclosed by a data user for the purpose of a due
diligence exercise to be conducted in connection with a proposed business
transaction that involves –
18
See Chapter 10 for further details.