86 / 192
may consider the underlying legal principles, statutory requirements and the reasonable
expectation of the data subjects on the further use of their publicly disclosed data.
7.28
For instance, in a case that came before the Commissioner, a data user had subscribed
for the provision of an online bulk service for public records from a public registry, which
contained personal data of third parties. The subscription contract with the public
registry contained provisions stipulating that the information obtained should not be sold
for the purpose of commercial gain. The data user subsequently developed and
explored new search engines enabling name searches to be undertaken by its own
subscribers. The act was viewed as a change in the purpose of use in contravention of
DPP3. Sometimes, the purpose of use is spelt out in the enabling legislation
7
and
sanctions may be imposed for improper use of the personal data.
8
The purpose
statement may serve to define or limit the scope of lawful uses to be applied by the
data user to the personal data obtained from the public registry.
7.29
Another illustration of the Commissioner’s position in this regard may be found in the
investigation report published in respect of a smartphone application (“app”) which
enabled users to search for a person’s litigation, bankruptcy and company director’s
data. The personal data made available through the app had been compiled by the
data user from data obtained from various public registries and websites, including
those maintained by the Judiciary, the Companies Registry and the Official Receiver’s
Office. In deciding whether the disclosure of such data through the app contravened
DPP3, the Commissioner first considered the original purpose of making the
complainants’ data publicly available by the Judiciary, the Companies Registry and the
Official Receiver’s Office:
•
Criminal litigation information: the Daily Cause List posted up in the Courts and
Judiciary website clearly states that the information therein is to facilitate witnesses,
defendants and/or related persons to attend the designated Court at the
scheduled time. Furthermore, the Judiciary will remove the hard copies posted up
the day following the conclusion of the trial while electronic copies will be removed
after three days.
•
Civil litigation information: the Cause Books, writ of summons and judgments are
made publicly available by the Judiciary in accordance with the relevant
ordinances and the principle of open justice. While members of the public may use
the parties’ names or other keywords to search relevant judgments uploaded on
the website of the Judiciary, they can only use the proceedings numbers or Court
document filing dates (but not the parties’ names or HKID numbers) as search
criteria to retrieve the writ of summons or the basic information
9
of a particular case
7
For example, section 136(4) of the Securities and Futures Ordinance, Cap 571 stipulates that the purposes of the register
of licensed persons and registered institutions available for public inspection are to enable members of the public to
ascertain whether he is dealing with a licensed person or a registered institution in matters connected with any
regulated activity, etc.
8
See, for example, section 22(3) of the Electoral Affairs Commission (Registration of Electors)(Legislative Council
Geographical Constituencies)(District Council Constituencies) Regulation, Cap 541A for sanctions imposed for improper
use of information obtained from the voters’ register.
9
The information recorded in the Cause Books includes action number, name of the solicitor taking out the writ, plaintiff’s
name, defendant’s name, claim nature and claim amount.