89 / 192
•
the use of the personal data as stated in the search records was confined to
transport and traffic matters and did not include the use of the personal data for
commercial benefits; and
•
the complainant’s reasonable privacy expectation when providing his personal
data to the Transport Department did not extend to cover the use of his personal
data in direct marketing.
Since the use of the personal particulars of the complainant in question for direct
marketing was entirely unrelated to transport and traffic matters, the Commissioner found
the act in question a contravention of DPP3.
Purposes Directly Related to the Original Purpose of Collection
7.34
DPP3(4)(b) allows personal data to be used for a purpose directly related to the original
purpose of collection. This makes sense as in many cases not all purposes of use of
personal data can be definitively stated on or before the collection of the personal
data by the data user. The concept of “directly related purpose” is of great practical
significance, without which the use of personal data for various incidental and
innocuous purposes by the data user may be hampered.
7.35
In assessing whether the act in question is done for a “directly related purpose” and thus
covered by DPP3(4)(b), the Commissioner will take into account factors such as:
• the nature of the transaction giving rise to the need to use the personal data; and
• the reasonable expectation of the data subject.
7.36
The need of the transaction in question is regarded as relevant because one would
expect that a data subject provides his personal data in order to enable or facilitate the
transaction with the data user. It would therefore be within the reasonable
contemplation of the data subject that the use of his personal data will consist of all
such uses as would be necessary to effect the intended transaction. In AAB No. 24/2009,
the complainant was named as a referee by his son in a loan application which was
submitted to an intermediary for the approval of the loan by a finance company. The
complainant complained to the Commissioner against the disclosure of his personal
data by the intermediary to the finance company. Having considered the nature of the
transaction, the Commissioner took the view that the disclosure of the referee’s personal
data to the finance company was for a directly related purpose, i.e. for processing the
loan application and hence was consistent with DPP3. The decision of the Commissioner
was upheld by the AAB.
7.37
In another appeal AAB No.46/2014, a salaried partner of a law firm complained against
the equity partners of supplying his personal data to a credit provider in a loan
application for the law firm as the borrower. The complainant maintained that he was
not made a borrower or guarantor personally in the application and hence his signature
was not required. The AAB accepted and agreed with the Commissioner that the
relevant personal data was provided by the equity partners to the credit provider for the
purpose of verifying the complainant’s identity as one of the partners of the law firm in
order to satisfy the due diligence measures under the Anti-Money Laundering and