98 / 192
(ii) incapable of managing his or her own affairs; or
(iii) mentally incapacitated within the meaning of section 2 of the Mental Health
Ordinance (Cap 136);
(b) the data subject is incapable of understanding the new purpose and deciding
whether to give the prescribed consent; and
(c) the relevant person has reasonable grounds for believing that the use of the data
for the new purpose is clearly in the interest of the data subject.
7.70
This legislative amendment aims to protect the vital interests of certain classes of vulnerable
data subjects, particularly in connection with the provision of essential services, such as
healthcare, education and social services. It also facilitates a data user to overcome the
practical difficulty in obtaining the prescribed consent from those data subjects who are
incapable of understanding the privacy impact of giving or withholding consent when their
personal data is to be used for a new purpose. A relevant person may be in a better
position to decide whether it is in the data subject’s interest to consent to the use of his
personal data for a new purpose.
7.71
Who is a “relevant person” for the purpose of DPP3(2)? According to section 2(1) of the
Ordinance, a
relevant person in relation to an individual (howsoever the individual is described), means –
(a) where the individual is a minor, a person who has parental responsibility for the minor;
(b) where the individual is incapable of managing his own affairs, a person who has been
appointed by a Court to manage those affairs;
(c) where the individual is mentally incapacitated within the meaning of section 2 of the
Mental Health Ordinance (Cap 136) –
(i) a person appointed under section 44A, 59O or 59Q of that Ordinance to be the
guardian of that individual; or
(ii) if the guardianship of that individual is vested in, or the functions of the appointed
guardian are to be performed by, the Director of Social Welfare or any other
person under section 44B(2A) or (2B) or 59T(1) or (2) of that Ordinance, the Director
of Social Welfare or that other person.
7.72
As a further safeguard against abuse or misuse, DPP3(3) requires a data user to make
necessary enquiries in order to form a reasonable belief that the new purpose of use is
clearly in the data subject’s interest. DPP3(3) provides as follows:
(3) A data user must not use the personal data of a data subject for a new purpose even if
the prescribed consent for so using that data has been given under subsection (2) by a
relevant person, unless the data user has reasonable grounds for believing that the use
of that data for the new purpose is clearly in the interest of the data subject.
7.73
Therefore, new privacy legislative safeguards have been built in to protect vulnerable
data subjects. Firstly, the class of persons who can give prescribed consent on behalf of
a data subject is limited to a
“
relevant person
”
as defined in section 2(1). Secondly, the
relevant person must be satisfied that the new purpose of use of the data subject’s