10 / 24
PCPD News 私隱專員公署通訊•
Issue no. 28
10
PCPD in action
公署動態
Case in Brief
個案摘要
Data Protection in Property Management
物業管理的資料保障
COVER STORY
專題報道
Mark Your Diary
活動日誌
Resources Updates
資源快訊
Statistics
統計
Glossary
詞彙
Technology Updates
科技新知
A4: Generally speaking, search engines
act merely as intermediaries and
only provide a tool for web users
to gather information dispersed in
various websites. In this manner, the
search engine operators are providing
content data rather than creating a
new use of the personal data which is
found in various websites.
Q5: Technology has made it easier than
ever to create online databases/
listings which provides convenient
search services. Did the PCPD’s
decision on the ‘Do No Evil’ case
mean to convey a message that the
creativity and development of the IT
technology should be suppressed?
A5: The Ordinance is technology-
neutral. Technology provides
conven i ence , e f f i c i ency and
effectiveness, but this is not a
justification for intrusion into
the privacy of individuals. Be
it a big corporation or a small
business, compliance with the
law should always be part and
parcel of an application of new
technology.
To determine whether it is an
intrusion on personal privacy,
we may look at the reasonable
expectations of the data subjects
on how their personal data will
be used. The test of reasonable
expec t a t i on i s s imp l y t o pu t
yourself in the data subject’s
s ho e s a nd a s k wh e t h e r y ou
would find the re-use of the data
unexpected, inappropriate or
otherwise objectionable.
for the number and details of
properties an individual owns, the
act would create a new purpose
of use of the personal data not
permissible under the Ordinance.
Q3: The pub l i c doma i n con t a i ns
sensitive personal data such as
Hong Kong Identity Card numbers.
Could one freely collect and use
these data?
A3: It is acceptable to access publicly
ava i l ab l e pe r sona l da t a . Bu t
performing value-added operations
on the personal data, such as
combining and processing, may
create a new use of the data which
deviates from the original purpose
of collecting the data and making it
public, and would thus contravene
the requirements of the Ordinance.
The PCPD recently secured the
cooperation of a website operator
t o cea s e ope r a t i ng an i ndex
which listed the names and HKID
numbers of individuals found in
the public domain to enable a
search by either name or HKID
number. Such aggregation and
processing of sensitive personal
data is clearly inappropriate and
objectionable from the perspective
of the data subject, as it enhances
the risk of identity theft, causing
administrative nuisance or financial
loss to the affected persons.
Q4: Is the operation of Internet search
engine acceptable under the
Ordinance?
Q1: I s i t a con t r aven t i on o f t he
Ordinance to obtain personal data
held by the Judiciary, Official
Receiver’s Office or Companies
Register and keep the data?
A1: Subject to some limitations, there is
generally no problem for members
of the public to collect, access and
keep such personal data. At issue is
the secondary use of that personal
data and whether the further use
constitutes a new purpose of use
which exceeds what the data
subject has consented to or his
reasonable expectation.
Anyone who obtained personal
data from the public domain must
use the data for a purpose which is
o sistent with, or directly related
to, the original purpose for which
it is collected and made public. If
the personal data is processed for a
new purpose, the prior consent of
the data subject must be obtained.
This is the requirement under the
Ordinance.
Q2: Could you give an example of
change of use of personal data
ob t a i n a b l e f r om t h e pub l i c
domain?
A2: The Land Registry facilitates search
of land records which enable
parties to property transactions
to ascertain the identity of the
property owner. However, if
someone gathers records from the
Land Registry and processes them
so as to facilitate users to search