Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

92 / 192

7.45 This principle of non-disclosure of unnecessary and excessive data can be illustrated in
the self-initiated investigation by the Commissioner against employment agencies for
domestic helpers. 15 Having considered the unique job nature of foreign domestic
helpers who must reside in their employers’ residence and who have to interact
intimately with the employers’ family, the Commissioner accepted that the posting on
an employment agencies’ websites of job applicants’ photographs and background
information (including their build, age, work experience, education level, nationality,
habits (e.g. smoker or not), religion, marital status, number of children, number of siblings
and the applicants’ ranking among them) will facilitate initial screening by prospective
employers. However, the disclosure of the name, address and passport/HKID number of
the applicants and the personal data of their family members and past employers was
unnecessary and excessive. The Commissioner commented that, unlike presenting the
job applicant’s profile to the prospective employer in person when the latter visits the
agencies’ offices, the display of the job applicant’s personal data online is subject to
unrestricted access by unidentified third parties, who may copy the data, retain the
data permanently, integrate or correlate the data with other fragmented data of the
same person from different sources. The possible secondary use of such data is beyond
a person’s anticipation or comprehension and definitely very difficult to control.
7.46 The extent of disclosure of personal data was also considered in a complaint handled
by the Commissioner. A government department collected a witness statement for the
purpose of prosecuting an offender and the standard form witness statement contained
the personal particulars of the witness, such as his name, address, HKID number, date of
birth and place of employment, etc. The department furnished the unedited version of
the witness statement in its entirety to the defendant. While it was accepted that the
disclosure of the contents of the statement made by the witness to the defendant was
necessary for the defendant to answer the charge, the disclosure of such personal
particulars of the witness, such as his HKID number, address, date of birth and place of
employment, was not justified in the circumstances of the case. Based upon the findings
of the Commissioner, the government department concerned agreed to revise its
operation manual so that unnecessary personal particulars of the witness would be
redacted before the witness statement was sent to other parties to the proceedings.16
7.47 A data user’s obligation to ensure that only necessary and relevant personal data
should be used or disclosed is best illustrated in the various scenarios of handling
property owners or occupiers’ personal data by property management companies and
owners corporations17 discussed below.
15 See Investigation Report No.R14-1382, available on the Website:
16 A similar approach was adopted in Wong Kar Gee Mimi v Hung Kin Sang Raymond & another [2011] 5 HKLRD 241, which
is a case concerning the making of an application for inspection by a shareholder of a company on various documents.
The Court granted the application and under the proper purpose requirement, the applicant was entitled to inspect the
payroll records of the employees which were confined to the names and the amount of the employees’ salary. Other
personal data, i.e. the addresses, telephone numbers, HKID numbers, email details and bank account details of the
employees had to be blanked out.
17 See Guidance on Property Management Practices issued by the Commissioner, available on the Website: