Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

required under DPP1(3) to be conveniently included in one written statement, generally

referred to as a PICS.

5.77

To facilitate understanding of the data user’s obligations under DPP1(3), the

Commissioner has published a Guidance Note on Preparing Personal Information

Collection Statement and Privacy Policy Statement which serves as general reference

for data users when preparing PICS and PPS.

The Purposes of Use

5.78

Under DPP1(3)(b)(i), the data subject is to be explicitly informed by the data user of “(A)

the purpose (in general or specific terms) for which the data is to be used, and (B) the

classes of persons to whom the data may be transferred”, on or before the collection of

the data.

5.79

Of the various kinds of information of which a data subject has to be informed under

DPP1(3), the above item (A) is perhaps the most important. This is because many of the

requirements of the Ordinance (including, for example, those under DPP1(1), DPP2, DPP3,

DPP5 and section 26, as well as some of the exemptions under Part 8) apply with

reference to the “purpose” of the collection of the data. Hence, a data user should

make sure that such purpose is reflected correctly and adequately in the PICS. It is

noteworthy that the purpose as stated in the PICS is one of the relevant factors, though

not necessarily the sole factor, that the Commissioner will look at in determining whether

there is contravention of any of the provisions of the Ordinance. For a detailed

discussion of those other factors that are also considered relevant in ascertaining the

permitted purpose of use, readers are referred to Chapter 7.

5.80

While a data user is allowed to state the purpose of use of personal data in compliance

with paragraph (A) of DPP1(3)(b)(i) in general terms, it should ensure that the data

subject can ascertain with a reasonable degree of certainty the purpose of use. In the

Octopus Card case mentioned above, one of the purposes of use was stated to be “as

a source of information and data for other related purposes”. The Commissioner found

the purpose of use too loosely worded as it could well include a “remotely related

purpose” as opposed to “direct related purpose”.

5.81

The same view was adopted by the Commissioner in the investigation into the collection

and use of personal data of the subscribers to the MoneyBack Programme run by

A. S. Watson Group (Hong Kong) Limited (“ASW”)

where a PICS was given to data

subjects, which provided for the use of personal data for “marketing goods and/or

services by [the ASW], our agent, our subsidiaries, or Our Partners”. Having considered

the nature of the programme, the Commissioner considered the purpose of use too

vague. Without specifying in detail the nature of the businesses of ASW’s subsidiaries and

The Guidance Note is available on the Website:

See Investigation Reports No. R12-3888 and R12-3890, available on the Website: