31 / 192
4.12
The meaning of data being held, processed or used “solely on behalf of another
person” and not for one’s “own purposes” is of particular relevance.
4.13
For example, a janitor was engaged for the service of regularly disposing of documents
that might contain personal data. Unless it can be shown that he collected the personal
data that might be found in the documents for his own purposes, generally he is not
considered, merely by collecting documents that might contain personal data for the
purpose of disposal, to come within the definition of a data user. Another example is
found in the case of the warehouse operators providing storage cubicles for use by their
customers. Chattels and documents may be stored but the operators generally have no
intention to collect the personal data that is found in these documents.
4.14
In AAB No.12/2013, a court clerk collected the personal data of a complainant before
taking notes in a magistrate’s court room. Since the purpose of collection was for the
management of the court but not for the court clerk’s own purpose, the AAB took the
view that the court clerk was not the data user.
1
4.15
Nowadays, the use of a third party contractor, such as a cloud service provider to store
electronic data on behalf of individuals and companies has become increasingly
popular. If the cloud service provider simply provides an electronic storage medium but
does not have any intention to collect the personal data which may be transmitted to it
for storage, it is to that extent not a data user as excluded under section 2(12).
4.16
By the same token, a service company providing secretarial services to a number of
shelf companies/individuals using its premises as a registered office is not a data user
when its staff collects incoming mail addressed to named individuals. This is because the
service company does not have its own purpose to serve in collecting the personal data
contained in the mail.
4.17
The requirements of the Ordinance do not apply to a person who is not a data user by
operation of section 2(12). However, an organisation engaging the services provided by
such person as an agent may be liable as principal under section 65(2) of the
Ordinance in respect of the personal data that was entrusted to the agent for handling.
Meaning of “Person” in the Context of Data User
4.18
Although one would expect that the Ordinance primarily seeks to address the abuse of
personal data by institutional data users, there is nothing in the definition of “data user”
to confine its meaning to institutions alone. Accordingly, insofar as an individual “controls
the collection, holding, processing or use” of personal data, the individual is a data user
in relation to the personal data and will consequently be subject to the full force of the
requirements under the Ordinance.
4.19
Another point to note in relation to the interpretation of “data user” is the meaning of
the word “person” and whether it extends to cover the Government as well. In this
connection, reference could be made to the interpretation of the word “person” as
1
In
AAB No.232/2013
, it was ruled that a rock climbing club, instead of the trainer retained by the club to provide training
and sign the certificate of completion of training, was the data user in question.