32 / 192
defined in section 3 of the Interpretation and General Clauses Ordinance (Cap 1):
“person” includes any public body and any body of persons, corporate or unincorporate,
and this definition shall apply notwithstanding that the word ‘person’ occurs in a provision
creating or relating to an offence or for the recovery of any fine or compensation.
4.20
The term “public body” is, in turn, defined in section 3 of Cap 1 as follows:
“public body” includes –
(a) the Executive Council;
(b) the Legislative Council;
. . .
(ca) any District Council;
. . .
(d) any other urban, rural or municipal council;
(e) any department of the Government; and
(f) any undertaking by or of the Government.
4.21
The Government as a whole is in possession of a substantial amount of personal data in
relation to the residents of Hong Kong. Such data has been collected and is retained by
various government bureaux and departments, according to their respective functions,
such as law enforcement, revenue, social welfare, medical services etc.
4.22
In light of the wide definitions of the terms “data user”, “person” and “public body”, such
terms may be interpreted to refer to either individual government bureaux and
departments as separate data users, or the entire Government (being a body of persons)
collectively as one single data user. However, in view of the vast array of functions the
Government performs in relation to individual residents which involve the collection and
use of personal data, the collective interpretation would effectively empower the
Government to collect, virtually without limitation as to the scope of the personal data,
and the exchange of such data among its various bureaux and departments. This would
give rise to an anomalous result contrary to one of the principal tenets of the Ordinance,
namely, to protect the personal data privacy of individuals by reference to the purpose
of collection of the data and its intended use by the relevant data user in relation to
that purpose.
4.23
Hence, so far as the relationship between the Government and residents is concerned,
the operational stance taken by the Commissioner is to interpret such terms to refer to
each individual government bureau and department as a separate data user.
2
Accordingly, under DPP1(1), a government department is not allowed to collect
personal data in excess of that required for its own function and activity (as opposed to
those of other government departments).
Furthermore, the transfer of data amongst
2
There may, however, be certain exceptions to this general rule, including, for example, the case of a civil servant who is
posted to different departments from time to time. In this situation, the government as a whole may be regarded as the
data user of personal data about the civil servant relating to his employment.