80 / 192
What Amounts to Use?
7.3
“Use”, in relation to personal data, is defined in section 2(1) of the Ordinance to include
the disclosure or transfer of the data. In addition to the conventional examples of
disclosure or use (e.g. transferring personal data to another organisation, or posting the
personal data on a notice board), the uploading or posting of personal data on the
internet would also amount to disclosure and would fall within the scope of DPP3(1).
What Is a New Purpose?
7.4
“New purpose” is defined in DPP3(4):
(4) In this section –
new purpose, in relation to the use of personal data, means any purpose other than –
(a) the purpose for which the data was to be used at the time of the collection of the
data; or
(b) a purpose directly related to the purpose referred to in paragraph (a).
7.5
Any use (including disclosure or transfer to a third party) of the personal data, which is
not directly related to the original purpose for which the personal data was collected,
will amount to a “new” use calling for the prescribed consent of the data subject. Failure
to obtain the prescribed consent of a data subject prior to such use may contravene
the requirements under DPP3. Data users must ascertain the lawful and permitted
purpose(s) of use which is relevant not only in respect of the application of DPP3, but
also for the application of other purpose-related provisions of the Ordinance, such as
DPP1(3), DPP2(2), DPP5 and section 26.
The Original Purpose of Collection
7.6
DPP3(1) and DPP3(4)(a) allow the use of personal data for the purpose for which the
data was originally collected. In ascertaining the original purpose of collection, the
following factors are relevant for consideration:
• the explicit purposes stated in the PICS given under DPP1(3);
• the function or activity of the data user;
• the restrictions of use imposed by the data subject or the transferor of the data; and
• personal data collected in the public domain.
The Purposes of Collection Stated in the PICS
7.7
It was mentioned in Chapter 5 that DPP1(3) requires a data user, on or before the
collection of personal data from a data subject, to take all reasonably practicable steps
to ensure that the data subject is informed, inter alia, of the purpose for which his data is
to be used. The informed purpose obviously reflects the data user’s then expectation
regarding the use of the data collected. But to what extent does this also reflect the
expectation of the data subject?