PCPD News Issue 28

7 / 24

7
PCPD News 私隱專員公署通訊•Issue no. 28
把個人資料整
合和加工處理
，編製成個人
檔案資料庫
Combining &
processing the
personal data to
pro le the
individuals
concerned
透過手機應用
程式供人查閱
Allow users to
access the
individual’s
records through
mobile app
‧ 按訂明目的將個人資料公開
Making the personal data
public according to the
prescribed purposes
‧ 限制再次使用用途/查閱
Restrictions on secondary
use of/access to the data
資料當事人
DATA SUBJECT
司法機構
Judiciary
破產管理署
Of cial Receiver’s Of ce
公司註冊署
Companies Registry
GDI
提供個人資料
Providing
personal data
收集個人資料
Collecting
personal data
資料使用者
DATA USER
法院審訊表
Court Daily Cause Lists
憲報刊載的破產告示
Bankruptcy Notices in
Gazette
公司登記冊
Annual Returns on
Companies Registry
公共領域
PUBLIC DOMAIN
It was found that GDI had collected
individuals’ litigation, bankruptcy
a n d c omp a n y d i r e c t o r s h i p d a t a
f r om d i f f e r en t sou r ce s , i nc l ud i ng
the Judiciary, the Official Receiver’s
Of f i ce ( “ORO” ) , t he Gaze t t e and
the Companies Registry, and formed
a d a t a b a s e . T h e A p p e n a b l e d
users to search the database for an
individual’s litigation and bankruptcy
data by his name or address. The
App publicised that it could be used
t o conduc t due d i l i gence r ev i ew
and background check for decisions
i nvo l v i ng t he o f f e r o f a j ob t o a
po t en t i a l emp l oy e e , i nc l ud i ng a
private tutor and a domestic helper;
s i gn i ng t enancy ag r eemen t s wi t h
p r o s p e c t i v e t e n a n t s ; o r s i g n i n g
contracts with business partners. In a
year’s time, the App had more than
40,000 downloads, and more than
200,000 search requests.
Importantly the App’s database is
i nv a l i d and i na c cu r a t e . F i r s t , a s
litigation records are not associated
with unique identification numbers,
it could be misleading to ascribe
them to an individual whose name is
not unique. Further, a litigant could
be innocent but the database did
not invariably include the court’s
j u d g eme n t . F i n a l l y , b a n k r u p t c y
i s d i s cha r g ed a f t e r f ou r t o e i gh t
y e a r s a n d t h e R e h a b i l i t a t i o n o f
O f f e n d e r s O r d i n a n c e p r e v e n t s
unauthorised disclosure of a minor
conviction provided the offender is
not reconvicted in the subsequent
three years. Therefore, the indefinite
retention and use of the bankruptcy
and litigation data would unduly
s t i gma t i s e an i nd i v i dua l and ba r
him from leading a life free from
encumbrances.
T h e l i t i g a t i o n a n d b a n k r u p t c y
records are made publicly available
by the government authorities for
specific purposes (see Table 1) which
clearly do not include supporting
GDI’s commercial venture to assist
g ene r a l con s ume r s t o che c k ou t
target persons behind their backs for
making decisions on employability
and creditworthiness. In practice,
while these public records enable
identification of individuals involved
in litigation and bankruptcy cases,
they do not facilitate record search
b y t h e i r n ame s . T h r o u g h v a l u e -
added aggregation and processing of
personal data, the App has in effect
created a new purpose of use of the
data in the public domain which
exceeds the reasonable expectation
o f t he da t a s ub j e c t s . Th i s i s no t
permissible under DPP3.
P r i v a c y C o mm i s s i o n e r i s s u e d
a n E n f o r c eme n t No t i c e t o GD I
on 31 J u l y 2013 , d i r e c t i n g i t t o
cease disclosing the litigation and
b a n k r u p t c y d a t a i t h e l d t o t h e
App users. GDI complied with the
directive on 7 August 2013.
Investigation Report:
english/publications/files/R13_9744_
e.pdf