82 / 192
The Lawful Functions and Activities of the Data User
7.12
As prescribed in DPP1(1), personal data shall be collected for a lawful purpose directly
related to the data user’s function or activity. Thus, the lawful function and activity of the
data user is a primary factor in deciding whether the use is proper, particularly in
situations where no PICS is given or where the drafting of the PICS is ambiguous. For
example, where the personal data of job applicants is received in a recruitment
exercise by company A (not being an employment agency), the referral by it of such
job applications to unrelated parties or other prospective employers without the job
applicants’ consent may exceed its normal functions and activities and thus constitute a
new purpose of use.
7.13
However, sometimes the function or activity of the data user may entail the disclosing of
personal data to another party. In a complaint that came before the Commissioner, flat
owner A repeatedly complained to the management company about water dripping
from the flat owned by B. As a result of the complaint, the management company
collected the personal data of B and, upon the request of A, the personal data was
disclosed to A who subsequently commenced civil proceedings against B. On appeal in
AAB No. 66/2003, the AAB upheld the Commissioner’s finding that since B’s personal
data was collected for the purpose of handling and following up on the dispute in
question, the disclosure of B’s personal data by the management company to A was for
a purpose consistent with the original purpose of collection and hence no prescribed
consent from B was required prior to the disclosure.
7.14
Another example can be found in AAB No.25/2012, where an enquiry made by the
complainant to a government department was referred by that government
department to the Judiciary, as it believed that the subject matter of the enquiry fell
within the Judiciary’s purview. The AAB affirmed the Commissioner’s view that by
forwarding the email containing the enquiry to the Judiciary for their information, the
government department was referring the enquiry to the appropriate department for
further handling and was using the data for the purpose for which it was intended at the
time of collection, namely to deal with the complainant’s enquiry.
7.15
It can be seen from the examples provided that the function and activity of a data user
is of particular relevance in ascertaining the lawful purpose of use of personal data. It is
especially so in relation to unsolicited data or data provided by third parties.
Restrictions of Use Imposed upon Data User by Data Provider or Data Subject
7.16
On some occasions, the person who provides the data (who may be the data subject
himself or a third party) may make an express stipulation on the use of the personal data.
Generally speaking, if the recipient has no intention to compile information about the
individual in the Eastweek sense,
2
such restrictions on use imposed, if any, might not
have a part to play and the Ordinance has no application as the recipient did not
collect the personal data in question. However, if the recipient subsequently compiled
information about the individual whom it has identified or intends to or seeks to identify,
the restrictions on use imposed by the data provider may then become a relevant
factor for consideration.
2
See Chapter 3.