Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

refers to the purpose for which the data was originally collected. In this case, such

original purpose would refer to the purpose of the Judiciary as the data user who first

collected the relevant data. The AAB did not accept that the purpose of the appellant

(the operator of Webb-site) for using the complainant’s personal data (i.e. reporting and

publication for general use) can be said to be consistent with the Judiciary’s purposes of

publishing the judgments (i.e. to enable their judgments to serve as “legal precedents

on points of laws, practice and procedure of the Courts and of public interests”). There

was nothing to suggest that the appellant’s purpose was in any way related to law. As

the appellant used the relevant personal data for a “new purpose”, the Commissioner

was correct in concluding that the appellant had contravened DPP 3. The AAB rejected

the appellant’s contention that such application of DPP3 to restrict the repetition of

public domain personal data was in violation of the principle of freedom of press and

expression as enshrined under the Basic Law of the Hong Kong Special Administrative

Region of the People’s Republic of China and the Bill of Rights Ordinance (Cap 383).The

AAB ruled that it was not unreasonable for the Commissioner to come to a decision in

favour of protecting the personal data of the complainant in the three edited

judgments.

7.32

In AAB No.25/2009, three career representatives of an insurance company made cold

calls to a civil servant using the name and office telephone number obtained from the

telephone directory of the Hong Kong Government accessible through its website,

which had a use restriction clause stating that:

• the information was not intended for direct marketing activities, or for the

dissemination or circulation of unsolicited publicity or advertising materials;

• advertisers should not use the information to promote their products or services; and

• the information contained therein should not be transferred for commercial gain.

The Commissioner was of the view that since the restriction clause had made clear that

the data obtained from the website could be used only for the facilitation of official

communication with the complainant and not for direct marketing, the three career

representatives had contravened DPP3. As the principal of the three career

representatives, the insurance company was also found liable by reason of section 65 of

the Ordinance.

7.33

In another investigation

carried out by the Commissioner, the personal particulars of

registered vehicle owners obtained from the public register of the Transport Department,

had been used by a management company for the purposes of promoting monthly

parking privileges. In his findings, the Commissioner gave due consideration to the

following matters:

•

the purpose of establishing the Register of Motor Vehicles stated in the enabling

legislation was “to provide for the regulation of road traffic and the use of vehicles

and roads (including private roads) and for other purposes connected therewith”;

See Investigation Report No. R12-3428, available on the Website: