Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

72 / 192

6.7 In an investigation conducted by the Commissioner, 1 the Inland Revenue Department
(“IRD”) was found to have failed to take all practicable steps to ensure the accuracy of
a taxpayer’s address. The IRD received a request for change of address from the
complainant and an officer of the IRD inadvertently input the complainant’s new
address into the database as the address reported by another taxpayer. As a result, the
tax demand note was sent to the wrong address and was returned by the post office. In
an attempt to rectify the mistake, another IRD officer input the wrong flat number in the
complainant’s address. The tax demand was again sent to a wrong address. The
mistake was not discovered until the complainant sent an email to the IRD complaining
about non-receipt of the tax demand note. The multiple human errors in this case
reflected the lack of awareness of data accuracy not only on the part of a single staff
member but across different units of the IRD. Considering the sensitive nature of the
personal data used for tax purposes, the Commissioner took the view that the IRD should
have adopted a higher degree of care in handling taxpayers’ personal data, and the
IRD was found to have contravened DPP2(1). As a result, the IRD revised its procedures
to eliminate the incidents of mismatching of data when a request for address change
was received and strengthened the daily supervisory checking to ensure compliance by
its staff of the procedures, guidelines and checklists issued by the IRD to ensure data
accuracy.
6.8 In contrast, complaints may be lodged with the Commissioner by one individual against
another involving an ongoing dispute about the “inaccuracy” of allegations, sometimes
defamatory in nature, made by one party against the other concerning certain events
which may arguably be his personal data. In this regard, the Commissioner would, in
general, decline to investigate such type of cases, insofar as the true essence of the
complaint lies not so much in the inaccuracy of personal data held, but in the dispute
between the parties.2 It is the court or tribunal of competent jurisdiction, rather than the
Commissioner, that is the appropriate forum for adjudicating such a dispute. The same
applies where the individual, having taken the further step of making a data correction
request to the other party, complains to the Commissioner about the refusal to “correct”
the data in the way he wanted. Comments made about a particular employee in a
dismissal letter are inherently contentious and the appellant in AAB No. 22/2000 sought
to correct the comments by making a data correction request. The AAB dismissed the
appeal and ruled that the proper channel for redressing the dispute was to commence
proceedings in the Labour Tribunal, not by way of a data correction request. (For further
discussion on data correction requests, readers are referred to Chapter 11).
6.9 In AAB No. 14/2011, a patient took out a claim in the Small Claims Tribunal against a
hospital for compensation. He obtained two medical reports from the attending doctor
and disputed the accuracy of the symptoms described of him as recorded in the reports.
The Commissioner refused to carry out an investigation as the alleged inaccurate
information was the medical opinion of the doctor and the Commissioner was not in a
position to determine its accuracy or otherwise. The AAB upheld the Commissioner’s
1 See Investigation Report No. R11-11778, available on the Website:
2 Under section 39(2)(ca) of the Ordinance, new statutory grounds were provided for the Commissioner to refuse to carry
out or decide to terminate an investigation if he is of the opinion that the primary subject matter of the complaint is not
related to the personal data privacy of individuals.