8 / 192
misunderstandings.
2.4
Information not represented in any document (hence not constituting personal data)
may be found in situations where, for example, there is real-time CCTV monitoring of
activities without the recording function being switched on, and information committed
to a person’s memory or information spoken (but not recorded). The question whether
verbal utterance amounts to disclosure of personal data was considered in AAB No.
21/1999 where a civil servant came to know certain sensitive personal information about
the complainant through handling the complainant’s complaint. Since there was no
evidence to prove that the sensitive personal information ever existed in a recorded
form, the AAB ruled that no personal data was involved and thus the case fell outside
the jurisdiction of the Commissioner. In AAB No. 6/2004, the verbal replies (not recorded)
given by certain employees to the employer in relation to the number of private
telephone calls made by a particular staff member and the contents thereof did not
constitute personal data of that staff member.
Definition of “Personal Data”
2.5
The definition of the term “personal data” is provided under section 2(1) of the
Ordinance as follows:
“ personal data” means any data –
(a) relating directly or indirectly to a living individual;
(b) from which it is practicable for the identity of the individual to be directly or indirectly
ascertained; and
(c) in a form in which access to or processing of the data is practicable.”
2.6
As explained above, the meaning of the term “data” is reasonably clear. Whether any
data constitutes personal data, therefore, depends on whether such data satisfies all of
the three conditions laid down in paragraphs (a), (b) and (c) in the definition of personal
data. However, given the generic nature of the terms used in those paragraphs, it is not
surprising that uncertainty may sometimes arise in their application as discussed below.
Paragraph (a) — “Relating Directly or Indirectly to a Living Individual”
2.7
The condition laid down in paragraph (a) in the definition of personal data requires the
data in question to be “relating directly or indirectly to” a living individual. However,
given that the concept of “relatedness” is very much a matter of degree, this may give
rise to difficulty in the application of paragraph (a).
2.8
The question of “relatedness” was considered by the UK court in detail. In Durant v
Financial Services Authority [2003] EWCA Civ 1746, it was held that what constituted
information that related to an individual being personal data was:
• whether the information was biographical in a significant sense; and
• that the information should have the individual as its focus rather than some other