28 / 192
Chapter 4
The Meaning of “Data User”
The main questions:
• What is the meaning of the term “data user”?
• What is the significance of the Eastweek case and how is it applied in the AAB cases?
• How is the meaning affected by section 2(12)?
• How does the term “data user” apply to an individual and the government?
• Can two or more persons be jointly accountable as data users?
• What is the relationship between a “data user” and a “data processor”?
• How does section 4 affect the obligations and liabilities of data users?
The questions discussed in this Chapter concerning the meaning of “data user” are selected
on the basis of their practical importance in light of the Commissioner’s own experience.
Before reading this Chapter, readers should read paragraphs 1.7 to 1.11 in Chapter 1 —
Introduction, which contain important general information on using this Book.
Meaning of “Data User” with Reference to the
Eastweek
case
4.1
The term “data user” is defined in section 2(1) of the Ordinance as follows:
“Data user”, in relation to personal data, means a person who, either alone or jointly or in
common with other persons, controls the collection, holding, processing or use of the data.
4.2
A person who satisfies the definition of a “data user” is obliged to observe and comply
with the relevant provisions and requirements under the Ordinance. As mentioned in
Chapter 3, the Court of Appeal judicially defined the meaning of the word “collect” in
the Eastweek case. Thus, it could be inferred that a person who passes the tests laid
down in the Eastweek case is a “data user” within the definition under section 2(1) as a
person who “. . . controls the collection . . . of the data”.
4.3
In AAB No. 22/1997, the AAB ruled that a secretary who was merely responsible for
transmitting the document passed to her by another staff member of the company did
not fall within the definition of a data user as she did not “control the collection, holding