29 / 192
or processing of the data contained in the document” and there was no evidence to
show a breach of DPP4 when the document was lost in transit.
4.4
Mere physical possession of a newspaper or magazine does not render the reader a
data user in relation to the personal data of individuals mentioned in the newspaper or
magazine. However, the situation might be different if the reader of the newspaper or
magazine intends to compile information about an identified individual, for example, a
celebrity or public figure for the purpose of, say, subsequent publishing of a dossier
about that person. It might then be argued that the reader became a data user
through his act of collection of the personal data in question.
4.5
While Eastweek is the landmark case which judicially defines the word “collect” and
therefore has an important bearing on the meaning of the term “data user”, there was
an earlier AAB decision on the issue of the meaning of “data user”. The AAB came to the
same conclusion as was reached at the subsequent Eastweek case. In AAB No. 4/1997,
a hospital employee lodged a complaint about an incident in which three hospitals had
permitted an open letter written by an employee, which contained the personal data of
the complainant, to be posted on their noticeboards. On appeal, the AAB upheld the
Commissioner’s decision not to investigate the case further. The AAB further observed:
Even if the hospitals had allowed or given consent for such posting, the hospitals could not be
taken as data users, since they only permitted the posting of the letters but they had no
control on the content or data mentioned in the open letter.
4.6
If one were to apply the Eastweek rationale to this AAB case, it might be argued that by
not having compiled information about the complainant, the hospitals did not “collect”
the complainant’s personal data in the Eastweek sense, which as a result, did not render
the hospitals “data users” vis-à -vis the personal data in question.
Meaning of “Data User” with Reference to More Recent AAB Cases
4.7
In the case of AAB No. 55/2006, an individual, on behalf of an organisation, wrote two
letters to a regulatory body concerning a complaint against a company. The regulatory
body forwarded the two letters to the company for their reply to the individual directly.
The individual then asked the company for copies of those two letters together with the
covering letter from the regulatory body, but the company refused to comply.
The
individual complained to the Commissioner that, in contravention of section 19 of the
Ordinance, the company had failed to provide him with copies of the requested letters
within forty days of his request. The Commissioner found that:
• the company had received the two letters from the individual on behalf of the
organisation for the purpose of dealing with the complaint made to the regulatory
body;
• the correspondence between the company and the regulatory body was about the
complaint and did not concern the individual personally; and
• there was no collection of personal data about the complainant by the company
and therefore the Ordinance did not apply.