Orden sobre los Datos de Carácter Personal (intimidad de los particulares) (C. 486), 1995, Hong Kong (China)

Long title

An Ordinance to protect the privacy of individuals in relation to personal data, and to provide for

Short title and commencement

(1) This Ordinance may be cited as the Personal Data (Privacy) Ordinance.

(2) This Ordinance shall come into operation on a day to be appointed by the Secretary for Home Affairs by notice in the Gazette.

(Enacted 1995)

Section 2 Interpretation

(1) In this Ordinance, unless the context otherwise requires“act” includes a deliberate omission; “adverse action”, in relation to an individual, means any action that may adversely affect the

individual’s rights, benefits, privileges, obligations or interests (including legitimate expectations); “appointed day” means the day appointed under section 1(2) ; “approved code of practice” means a code of practice approved under section 12 ; “code of practice” includes

(a)

a standard;

(b)

a specification; and

(c)

any other documentary form of practical guidance;

Legislative Texts

“Commissioner” means the Privacy Commissioner for Personal Data established under section 5(1) ;

“Committee” means the Personal Data (Privacy) Advisory Committee established under section 11(1) ;

“complainant” means the individual, or the relevant person on behalf of an individual, who has made a complaint;

“complaint” means a complaint under section 37 ;

“correction”, in relation to personal data, means rectification, erasure or completion;

“daily penalty” means a penalty for each day on which the offence is continued after conviction therefor;

“data” means any representation of information (including an expression of opinion) in any document, and includes a personal identifier;

“data access request” means a request under section 18 ;

“data correction request” means a request under section 22(1) ;

“data protection principle” means any of the data protection principles set out in Schedule 1;

“data subject”, in relation to personal data, means the individual who is the subject of the data;

“data user”, in relation to personal data, means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data;

“data user return” means a data user return referred to in section 14(4) ;

“disclosing”, in relation to personal data, includes disclosing information inferred from the data;

“document” includes, in addition to a document in writing

(a) �

a disc, tape or other device in which data other than visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the disc, tape or other device; and

(b) �

a film, tape or other device in which visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the film, tape or other device;

“employment” means employment under

(a) �

a contract of service or of apprenticeship; or

(b) a contract personally to execute any work or labour; and related expressions shall be construed accordingly;

“enforcement notice” means a notice under section 50(1) ;

“financial regulator” means any of

(a) �

the Monetary Authority appointed under section 5A of the Exchange Fund Ordinance (Cap 66);

(b) �

the Securities and Futures Commission established by section 3 of the Securities and Futures Commission Ordinance (Cap 24);

Legislative Texts

(c) �

a clearing house within the meaning of section 2(1) of the Commodities Trading Ordinance (Cap 250) or a recognized clearing house within the meaning of the Securities and Futures (Clearing Houses) Ordinance (Cap 420);

(d) �

the Exchange Company within the meaning of section 2(1) of the Commodities Trading Ordinance (Cap 250);

(e) �

the Exchange Company within the meaning of section 2(1) of the Stock Exchanges Unification Ordinance (Cap 361);

(f) �

the Insurance Authority appointed under section 4 of the Insurance Companies Ordinance (Cap 41);

(g) �

the Registrar of Occupational Retirement Schemes appointed under section 5 of the Occupational Retirement Schemes Ordinance (Cap 426);

(ga) �the Mandatory Provident Fund Schemes Authority established by section 6 of the Mandatory Provident Fund Schemes Ordinance (Cap 485); (Added 4 of 1998 s. 14)

(h) �

a person specified in a notice under subsection (7) to be a regulator for the purposes of this definition;

“inaccurate”, in relation to personal data, means the data is incorrect, misleading, incomplete or obsolete;

“inspection” means an inspection under section 36 ;

“investigation” means an investigation under section 38 ;

“log book”, in relation to a data user, means the log book kept and maintained by the data user under section 27(1) ;

“matching procedure” means any procedure whereby personal data collected for 1 or more purposes in respect of 10 or more data subjects are compared (except by manual means) with personal data collected for any other purpose in respect of those data subjects where the comparison

(a) �

is (whether in whole or in part) for the purpose of producing or verifying data that; or

(b) �

produces or verifies data in respect of which it is reasonable to believe that it is practicable that the data,

may be used (whether immediately or at any subsequent time) for the purpose of taking adverse action against any of those data subjects;

“matching procedure request” means a request under section 31(1) ;

“personal data” means any data

(a) �

relating directly or indirectly to a living individual;

(b) �

from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and

(c) �

in a form in which access to or processing of the data is practicable;

“personal data system” means any system, whether or not automated, which is used, whether in whole or in part, by a data user for the collection, holding, processing or use of personal data, and includes any document and equipment forming part of the system;

“personal identifier” means an identifier-

Legislative Texts

(a) �that is assigned to an individual by a data user for the purpose of the operations of the user; and

(b) �that uniquely identifies that individual in relation to the data user, but does not include an individual’s name used to identify that individual; “practicable” means reasonably practicable; “prescribed officer” means a person employed or engaged under section 9(1) ; “processing”, in relation to personal data, includes amending, augmenting, deleting or rearranging the data, whether by automated means or otherwise; “register” means the register of data users kept and maintained by the Commissioner under

section 15(1) ; “relevant data user”, in relation to

(a) �

an inspection, means the data user who uses the personal data system which is the subject of the inspection;

(b) �

a complaint, means the data user specified in the complaint;

(c) �

an investigation

(i) �

in the case of an investigation initiated by a complaint, means the data user specified in the complaint;

(ii) �

in any other case, means the data user the subject of the investigation;

(d)

an enforcement notice, means the data user on whom the notice is served;
�“relevant person”, in relation to an individual (howsoever the individual is described), means

(a) �

where the individual is a minor, a person who has parental responsibility for the minor;
�

(b) �

where the individual is incapable of managing his own affairs, a person who has been appointed by a court to manage those affairs;

(c) �

in any other case, a person authorized in writing by the individual to make a data access request, a data correction request, or both such requests, on behalf of the individual;

“requestor”, in relation to

(a) �

a data access request or data correction request, means the individual, or the relevant person on behalf of an individual, who has made the request;

(b)

a matching procedure request, means the data user who has made the request;
�“specified”, in relation to a form, means specified under section 67 ;
�“third party”, in relation to personal data, means any person other than

(a) �

the data subject;

(b) �

a relevant person in the case of the data subject;

(c) �

the data user; or

(d) �

a person authorized in writing by the data user to collect, hold, process or use the data

(i) �

under the direct control of the data user; or

(ii) �

on behalf of the data user;

Legislative Texts

“use”, in relation to personal data, includes disclose or transfer the data;

“would be likely to prejudice” includes would prejudice.

(2)

For the avoidance of doubt, it is hereby declared that paragraph (c) of the definition of “relevant person” shall not be construed

(a) �

to entitle a person who has only been authorized to make a data access request on behalf of an individual to make a data correction request on behalf of the individual;

(b) �

to entitle a person who has only been authorized to make a data correction request on behalf of an individual to make a data access request on behalf of the individual.

(3)

Where under this Ordinance an act may be done with the prescribed consent of a person (and howsoever the person is described), such consent

(a) �

means the express consent of the person given voluntarily;

(b) �

does not include any consent which has been withdrawn by notice in writing served on the person to whom the consent has been given (but without prejudice to so much of that act that has been done pursuant to the consent at any time before the notice is so served).

(4)

Subject to section 64(10) , it is hereby declared that any reference in this Ordinance to the effect that a data user (howsoever described)

(a) �

has contravened a requirement under this Ordinance; or

(b) �

is contravening a requirement under this Ordinance, includes

(i) �

where paragraph (a) is applicable, any case where the data user has done an act, or engaged in a practice, in contravention of a data protection principle;

(ii) �

where paragraph (b) is applicable, any case where the data user is doing an act, or engaging in a practice, in contravention of a data protection principle.

(5)

Notwithstanding any other provisions of this Ordinance, a complaint may be made (and an investigation, if any, initiated by the complaint may be carried out) in relation to a person who has ceased to be a data user except any such person who has not at any time been a data user during the period of 2 years immediately preceding the date on which the Commissioner receives the complaint and, accordingly, a person in relation to whom such a complaint is made shall for the purposes of such complaint (and an investigation, if any, initiated by such complaint) be deemed to be a data user, and the other provisions of this Ordinance shall be construed accordingly.

(6)

Any reference in this Ordinance to a data protection principle followed by a number is a reference to the principle bearing that number set out in Schedule 1.

(7)

The Chief Executive may, by notice in the Gazette, specify a person to be a regulator for the purposes of the definition of “financial regulator”. (Amended 34 of 1999 s. 3)

(8)

It is hereby declared that a notice under subsection (7) is subsidiary legislation.

(9)

Where a person

(a) �

holds any office, engages in any profession or carries on any occupation; and

(b) �

is required by any law, or by any rules made under or by virtue of any law, to be a fit and proper person (or words to the like effect) to hold that office, engage in that profession or carry on that occupation,

Legislative Texts

then, for the purposes of this Ordinance, any conduct by that person by virtue of which he ceases, or would cease, to be such a fit and proper person shall be deemed to be seriously improper conduct.

(10)

Subsection (9) shall not operate to prevent seriously improper conduct including, for the purposes of this Ordinance, conduct by virtue of which a person ceases, or would cease, to be a fit and proper person notwithstanding that the conduct is not conduct to which that subsection applies.

(11)

Words and expressions importing the neuter gender in relation to any data user shall include the masculine and feminine genders.

(12)

A person is not a data user in relation to any personal data which the person holds, processes or uses solely on behalf of another person if, but only if, that first-mentioned person does not hold, process or use, as the case may be, those data for any of his own purposes.

(13)

For the avoidance of doubt, it is hereby declared that, for the purposes of this Ordinance, any conduct by a person by virtue of which he has or could become a disqualified person or a suspended person under the Rules of Racing and Instructions by the Stewards of the Hong Kong Jockey Club, as in force from time to time, is seriously improper conduct. (Amended 34 of 1999 s. 3)

(Enacted 1995)

Section 4 Data protection principles

A data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or practice, as the case may be, is required or permitted under this Ordinance.

(Enacted 1995)

Section 5 Establishment, etc. of Privacy Commissioner for Personal Data

* See Decision of the Standing Committee of the National People's Congress on Treatment of the Laws Previously in Force in Hong Kong in accordance with Article 160 of the Basic Law of the Hong Kong Special Administrative Region of the People's Republic of China, which is published in volume 1, p. 11/1.

Legislative Texts

Remarks:

Adaptation amendments retroactively made—see 34 of 1999 s. 3

(1)

For the purposes of this Ordinance, there is hereby established an office by the name of the Privacy Commissioner for Personal Data.

(2)

The Commissioner shall be a corporation sole with perpetual succession and

(a) �

shall have and may use a seal; and

(b) �

shall be capable of suing and being sued.

(3)

The Chief Executive shall, by notice in the Gazette, appoint a person to be the Commissioner. (Amended 34 of 1999 s. 3)

(4)

Subject to subsection (5) , the person appointed to be the Commissioner shall hold office for a period of 5 years and shall be eligible for reappointment for not more than 1 further period of 5 years.

(5)

The person appointed to be the Commissioner may

(a) �

at any time resign from his office by notice in writing to the Chief Executive; or

(b) �

be removed from office by the Chief Executive with the approval by resolution of the Legislative Council on the ground of

(i) �

inability to perform the functions of his office; or

(ii) �

misbehaviour. (Amended 34 of 1999 s. 3)

(6)

The Chief Executive shall determine- (Amended 34 of 1999 s. 3)

(a) �

the emoluments; and

(b)

the terms and conditions of appointment, of the person appointed to be the Commissioner.

(7) The provisions of Schedule 2 shall have effect with respect to the Commissioner.

(8)

Subject to subsection (9) , the Commissioner shall not be regarded as a servant or agent of the Government or as enjoying any status, immunity or privilege of the Government.

(9)

The person appointed to be the Commissioner shall be deemed to be a public servant

(a) �

within the meaning of section 2 of the Prevention of Bribery Ordinance (Cap 201); and

(b) �

for the purposes of that Ordinance. (Enacted 1995)

Section 6
�Commissioner to hold no other office
�

Remarks:

Adaptation amendments retroactively made—see 34 of 1999 s. 3

The person appointed to be the Commissioner shall not, without the specific approval of the Chief Executive- (Amended 34 of 1999 s. 3)

Legislative Texts

Section 7
�Filling of temporary vacancy
�

Remarks:

Adaptation amendments retroactively made—see 34 of 1999 s. 3

(1)

Where the person appointed to be the Commissioner

(a)

dies;

(b)

resigns;

(c)

is removed from office;

(d)

is absent from Hong Kong; or

(e)

is for any other reason unable to perform the functions of his office,

then the Chief Executive may, by notice in writing, appoint a person to act as the Commissioner until, as the case requires-(Amended 34 of 1999 s. 3)

(i)

a new Commissioner is appointed under section 5(3) ; or

(ii)

the Commissioner resumes his office.

(2)

A person appointed under subsection (1) to act as the Commissioner, whilst he is so appointed

(a) shall perform the functions; and

(b)

may exercise the powers, of the Commissioner under this Ordinance.

(3)

Section 6 shall apply to a person appointed under subsection (1) to act as the Commissioner as if that person were the Commissioner.

(Enacted 1995)

Section 8 Functions and powers of Commissioner

Remarks:

Adaptation amendments retroactively made—see 34 of 1999 s. 3

(1)

The Commissioner shall

(a)

monitor and supervise compliance with the provisions of this Ordinance;

Legislative Texts

(b) �

promote and assist bodies representing data users to prepare, for the purposes of section 12 , codes of practice for guidance in complying with the provisions of this Ordinance, in particular the data protection principles;

(c) �

promote awareness and understanding of, and compliance with, the provisions of this Ordinance, in particular the data protection principles;

(d) �

examine any proposed legislation (including subsidiary legislation) that the Commissioner considers may affect the privacy of individuals in relation to personal data and report the results of the examination to the person proposing the legislation;

(e) �

carry out inspections, including inspections of any personal data systems used by data users which are departments of the Government or statutory corporations;

(f) �

for the better performance of his other functions, undertake research into, and monitor developments in, the processing of data and computer technology in order to take account of any likely adverse effects such developments may have on the privacy of individuals in relation to personal data;

(g) �

liaise and co-operate with any person in any place outside Hong Kong

(i) �

performing in that place any functions which, in the opinion of the Commissioner, are similar (whether in whole or in part) to any of the Commissioner’s functions under this Ordinance; and

(ii) �

in respect of matters of mutual interest concerning the privacy of individuals in relation to personal data; and

(h) �

perform such other functions as are imposed on him under this Ordinance or any other enactment.

(2) The Commissioner may do all such things as are necessary for, or incidental or conducive to, the better performance of his functions and in particular but without prejudice to the generality of the foregoing, may

(a) �

acquire and hold property of any description if in the opinion of the Commissioner such property is necessary for

(i) �

the accommodation of the Commissioner or of any prescribed officer; or

(ii) �

the performance of any function which the Commissioner may perform, and, subject to the terms and conditions upon which such property is held, dispose of it;

(b) �

enter into, carry out, assign or accept the assignment of, vary or rescind, any contract, agreement or other obligation;

(c) �

undertake and execute any lawful trust which has as an object the furtherance of any function which the Commissioner is required or is permitted by this Ordinance to perform or any other similar object;

(d) �

accept gifts and donations, whether subject to any trust or not;

(e) �

with the prior approval of the Chief Executive, become a member of or affiliate to any international body concerned with (whether in whole or in part) the privacy of individuals in relation to personal data; (Amended 34 of 1999 s. 3)

(f) �

exercise such other powers as are conferred on him under this Ordinance or any other enactment.

Legislative Texts

(3)

The Commissioner may make and execute any document in the performance of his functions or the exercise of his powers or in connection with any matter reasonably incidental to or consequential upon the performance of his functions or the exercise of his powers.

(4)

Any document purporting to be executed under the seal of the Commissioner shall be admitted in evidence and shall, in the absence of evidence to the contrary, be deemed to have been duly executed.

(5)

The Commissioner may from time to time cause to be prepared and published by notice in the Gazette, for the guidance of data users, guidelines not inconsistent with this Ordinance, indicating the manner in which he proposes to perform any of his functions, or exercise any of his powers, under this Ordinance.

(Enacted 1995)

Section 9
�Staff of Commissioner, etc.
�

(1)

The Commissioner may

(a) �

employ such persons (including technical and professional persons); and

(b) �

engage, other than by way of employment, such technical and professional persons, as he thinks fit to assist him in the performance of his functions, and the exercise of his powers, under this Ordinance.

(2)

The Commissioner shall determine

(a) �

the remuneration and terms and conditions of employment of any person, or any person belonging to a class of persons, who may be employed under subsection (1)(a) ;

(b) �

the remuneration and terms and conditions of engagement of any person, or any person belonging to a class of persons, who may be engaged under subsection (1)(b) .

(3)

The Commissioner may

(a) �

grant, or make provision for the grant of, pensions, gratuities and retirement benefits to employees;

(b) �

provide other benefits for the welfare of employees and their dependants;

(c) �

authorize payments, whether or not legally due, to the personal representatives of a deceased employee or to any person who was dependent on such employee at his death.

(4)

The Commissioner may

(a) �

establish, manage and control; or

(b) �

enter into an arrangement with any company or association for the establishment, management and control by that company or association either alone or jointly with the Commissioner of,

any fund or scheme for the purpose of providing for the pensions, gratuities, benefits and payments referred to in subsection (3) .

(5) The Commissioner may make contributions to and may require employees to make contributions to any fund or scheme referred to in subsection (4) .

Legislative Texts

(6) In this section “employees” includes any class of employee which the Commissioner specifies and in subsection (3) includes former employees.

(Enacted 1995)

Section 10
�Delegations by Commissioner
�

(1) Subject to subsection (2) , the Commissioner may delegate in writing any of his functions or powers under this Ordinance to any prescribed officer subject to such terms and conditions, if any, as he thinks fit and specified in the delegation.

(2)

The Commissioner shall not delegate any of his functions or powers under

(a) �

subsection (1) ;

(b) �

any provisions of any regulations made under this Ordinance which are specified in the regulations as provisions which shall not be subject to subsection (1) ;

(c) �

any provisions of Schedule 2 which are specified in that Schedule as provisions which shall not be subject to subsection (1) .

(3)

A delegate of the Commissioner

(a) �

shall perform the delegated functions and may exercise the delegated powers as if the delegate were the Commissioner; and

(b) �

shall be presumed to be acting in accordance with the relevant delegation in the absence of evidence to the contrary.

(Enacted 1995)

Section 11
�Establishment of Personal Data (Privacy) Advisory Committee
�

(1)

There is hereby established a committee by the name of the Personal Data (Privacy) Advisory Committee for the purpose of advising the Commissioner upon any matter relevant to the privacy of individuals in relation to personal data or otherwise relevant to the operation of this Ordinance.

(2)

The Committee shall consist of

(a) �

the Commissioner, who shall be the chairman; and

(b) �

not less than 4 or more than 8 other persons, appointed by the Secretary for Home Affairs, of whom

(i) �

not less than 1 shall have not less than 5 years’ experience in the processing of data; and

(ii) �

not more than 1 shall be a public officer.

(3)

The members of the Committee appointed under subsection (2)(b) shall hold office for such period and upon such terms as the Secretary for Home Affairs specifies in their respective appointments or from time to time.

(4)

A member of the Committee appointed under subsection (2)(b) may resign at any time by notice in writing delivered to the Secretary for Home Affairs.

Legislative Texts

(5) The Committee may regulate its procedure.
�

(Enacted 1995)
�

Section 14 Data user returns

(1)

Subject to subsection (2) , the Commissioner may, by notice in the Gazette, specify a class of data users to which this section shall apply.

(2)

The Commissioner shall, before specifying a class of data users in a notice under subsection (1) , consult with

(a) �such bodies representative of data users belonging to that class; and

(b)

such other interested persons, as he thinks fit.

(3)

This section shall not apply to a data user except a data user belonging to a class of data users specified in a notice under subsection (1) which is in force.

(4)

A data user shall submit to the Commissioner a data user return

(a) �

in the specified form;

(b) �

containing the prescribed information required by the return in relation to the data user;

(c) �

in the case of

(i) �

a data user which belongs to the class of data users concerned on the day on which the notice under subsection (1) specifying that class commences, not earlier than 3 months before, and not later than, each anniversary of that day;

(ii) �

a data user which first belongs to the class of data users concerned on a day after the day on which the notice under subsection (1) specifying that class commences, not earlier than 3 months before, and not later than, each anniversary of that first-mentioned day; and

(d) �

accompanied by the prescribed fee.

(5)

The Commissioner shall cause a notice to be published not less than once during every period of 6 months

(a) �in

(i) �

the Gazette; and

(ii) �

not less than 1 Chinese language newspaper (and in the Chinese language) and not less than 1 English language newspaper (and in the English language), each of which shall be a newspaper circulating generally in Hong Kong; and

Legislative Texts

(b) �subject to subsection (6) , specifying the places at which and the hours during which data user returns are available to be obtained by data users for the purposes of this section.

(6)

The Commissioner shall not exercise his power under subsection (5)(b) to specify places which are Government offices unless and until he has the approval in writing of the Secretary for Home Affairs to do so.

(7)

The Commissioner shall cause data user returns to be available to be obtained by data users

(a) �

free of charge; and

(b) �

at the places and during the hours specified in the last notice published under subsection (5) .

(8)

Where any prescribed information contained in a data user return submitted under subsection (4) to the Commissioner by a data user changes subsequent to the submission, then the data user shall serve a notice in writing on the Commissioner specifying such change

(a) �

if, but only if

(i) �

such information is specified in the return as information to which this subsection applies; and

(ii) �

the return contains, or has annexed to it

(A) �

a copy of this subsection; or

(B) �

a statement summarizing the requirement imposed by this subsection on the data user; and

(b) �

not later than 30 days after such change.

(9)

It is hereby declared that

(a) �

a notice under subsection (1) is subsidiary legislation;

(b) �

where a data user belongs to 2 or more classes of data users specified in 2 or more notices under subsection (1) which are in force, then, for the purposes of this section, that data user shall be deemed to belong only to that class of data users specified in the first of those notices to be published in the Gazette; and

(c) �

subsection (3) shall not operate to prejudice the generality of section 67(4)(c) .

(10)

In this section and section 15 , “prescribed information” means any information specified in Schedule 3 .

(Enacted 1995)

Section 15
�Register of data users
�

(1)

The Commissioner shall use

(a) �

data user returns submitted to him under section 14(4) ; and

(b) any notices served on him under section 14(8) , to keep and maintain a register of data users which have submitted such returns.

Legislative Texts

(2)

The register shall

(a) �

be in the form of a database; and

(b) �

contain, in respect of each data user who has submitted a data user return under section 14(4) , such particulars of the information supplied in that return as the Commissioner thinks fit.

(3)

The Commissioner may, by notice in writing served on a data user, require the data user to submit a notice in the prescribed form containing such prescribed information in relation to the data user as the Commissioner may reasonably require in order to keep and maintain the register in so far as it relates to that data user, and the data user shall so submit the second-mentioned notice within such period (being a period of not less than 30 days after service of the first-mentioned notice) and in such manner as the Commissioner requires in the first-mentioned notice.

(4)

Where any prescribed information submitted to the Commissioner under subsection (3) by a data user changes subsequent to the submission, then the data user shall serve a notice in writing on the Commissioner specifying such change

(a) �

if, but only if

(i) �

such information is specified in the notice concerned under that subsection as information to which this subsection applies; and

(ii) �

the notice referred to in subparagraph (i) contains, or has annexed to it

(A) �

a copy of this subsection; or

(B) �

a statement summarizing the requirement imposed by this subsection on the data user; and

(b) �

not later than 30 days after such change.

(5)

If the Commissioner is satisfied that a person has ceased to be a data user, he may delete from the register any particulars contained therein relating to that person in that person’s capacity as a data user.

(6)

A person who has ceased to be a data user may, by notice in the specified form served on the Commissioner, request the Commissioner to delete from the register the particulars contained therein relating to that person in that person’s capacity as a data user, and the Commissioner shall, not later than 3 months after the date on which he receives that notice, comply with that request unless it has been withdrawn by that person.

(Enacted 1995)

Section 16
�Inspection of register
�

(1) The Commissioner shall provide facilities for making the particulars contained in the register available for inspection

(a) �

by any person;

(b) �

in visible and legible form;

(c) �

during ordinary office hours; and

(d) �

free of charge.

Legislative Texts

(2)

The Commissioner shall

(a) �

on receipt of an application in the specified form from a person; and

(b) �

on payment of the prescribed fee,

provide a copy in writing of the particulars contained in the register in respect of the data user, or the class of data users, specified in the application.

(Enacted 1995)

Section 17
�Register shall not limit, etc. operation of this Ordinance
�

(1)

For the avoidance of doubt, it is hereby declared that

(a) �

whether or not the register contains any particulars;

(b)

any particulars contained in the register, in respect of a data user shall not of itself

(i) �

limit, restrict or qualify the operation of any of the provisions of this Ordinance (including section 2(5) and the data protection principles) in relation to the data user;

(ii) �

exempt the data user from the operation of any of the provisions of this Ordinance.

(2)

Subsection (1) shall not prejudice the operation of any limitation, restriction, qualification or exemption provided for in the other provisions of this Ordinance.

(Enacted 1995)

Section 18
�Data access request
�

(1)

An individual, or a relevant person on behalf of an individual, may make a request

(a) �

to be informed by a data user whether the data user holds personal data of which the individual is the data subject;

(b) �

if the data user holds such data, to be supplied by the data user with a copy of such data.

(2)

A data access request under both paragraphs of subsection (1) shall be treated as being a single request, and the provisions of this Ordinance shall be construed accordingly.

(3)

A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to the contrary, be treated as being a data access request under both paragraphs of that subsection, and the provisions of this Ordinance (including subsection (2) ) shall be construed accordingly.

(4) A data user who, in relation to personal data-

Legislative Texts

(a) �

does not hold the data; but

(b) �

controls the use of the data in such a way as to prohibit the data user who does hold the data from complying (whether in whole or in part) with a data access request which relates to the data,

shall be deemed to hold those data, and the provisions of this Ordinance (including this section) shall be construed accordingly.

(Enacted 1995)

Section 19
�Compliance with data access request
�

(1)

Subject to subsection (2) and sections 20 and 28(5) , a data user shall comply with a data access request not later than 40 days after receiving the request.

(2)

A data user who is unable to comply with a data access request within the period specified in subsection (1) shall

(a) �

before the expiration of that period

(i) �

by notice in writing inform the requestor that the data user is so unable and of the reasons why the data user is so unable; and

(ii) �

comply with the request to the extent, if any, that the data user is able to comply with the request; and

(b) �

as soon as practicable after the expiration of that period, comply or fully comply, as the case may be, with the request.

(3)

A copy of the personal data to be supplied by a data user in compliance with a data access request shall

(a) �

be supplied by reference to the data at the time when the request is received except that the copy may take account of

(i) �

any processing of the data

(A) �

made between that time and the time when the copy is supplied; and

(B) �

that would have been made irrespective of the receipt of the request; and

(ii) �

subject to subsection (5) , any correction to the data made between that time and the time when the copy is supplied;

(b) �

where any correction referred to paragraph (a)(ii) has been made to the data, be accompanied by a notice stating that the data have been corrected pursuant to that paragraph (or words to the like effect); and

(c) �

as far as practicable, be

(i) �

intelligible unless the copy is a true copy of a document which

(A) �

contains the data; and

(B) �

is unintelligible on its face;

Legislative Texts

(ii) �readily comprehensible with any codes used by the data user adequately explained; and

(iii) �in

(A) �

subject to sub-subparagraph (B) , the language specified in the request or, if no language is so specified, the language in which the request is made (which may be the Chinese or English language in either case);

(B) �

a language other than the language specified in the request or, if no language is so specified, the language in which the request is made, if, but only if

(I) �

the language in which the data are held is not the language specified in the request or, if no language is so specified, the language in which the request is made, as the case may be; and

(II) �

subject to section 20(2)(b) , the copy is a true copy of a document which contains the data;

(iv) �

without prejudice to the generality of subparagraph (iii) but subject to subsection (4) , be in the form, or one of the forms, if any, specified in the request;

(v) �

where subparagraph (iv) is not applicable, in such form as the data user thinks fit.

(4)Where

(a) �

a data access request specifies the form or forms in which a copy of the personal data to be supplied in compliance with the request is or are sought; and

(b) �

the data user concerned is unable to supply the copy in that form or any of those forms, as the case may be, because it is not practicable for the data user to do so,

then the data user shall

(i) �

where there is only one form in which it is practicable for the data user to supply the copy, supply the copy in that form accompanied by a notice in writing informing the requestor that that form is the only form in which it is practicable for the data user to supply the copy;

(ii) �

in any other case

(A) �

as soon as practicable, by notice in writing inform the requestor

(I) �

that it is not practicable for the data user to supply the copy in the form or any of the forms, as the case may be, specified in the request;

(II) �

of the forms in which it is practicable for the data user to supply the copy; and

(III) �that the requestor may, not later than 14 days after the requestor has received the notice, specify in writing one of the forms referred to in sub- subparagraph (II) in which the copy is to be supplied; and

(B) �

as soon as practicable, supply the copy-

Legislative Texts

(I) �

in the form specified in the response, if any, to the notice referred to in subparagraph (A) ;

(II) �

if there is no such response within the period specified in subparagraph (A)(III) , supply the copy in any one of the forms referred to in subparagraph (A)(II) as the data user thinks fit.

(5) Subparagraph (ii) of paragraph (a) and paragraph (b) of subsection (3) shall expire on the 1st anniversary of the appointed day.

(Enacted 1995)

Section 20
�Circumstances in which data user shall or may refuse to comply with data
�access request
�

(1)

A data user shall refuse to comply with a data access request

(a) �

if the data user is not supplied with such information as the data user may reasonably require

(i) �

in order to satisfy the data user as to the identity of the requestor;

(ii) �

where the requestor purports to be a relevant person, in order to satisfy the data user

(A) �

as to the identity of the individual in relation to whom the requestor purports to be such a person; and

(B) �

that the requestor is such a person in relation to that individual;

(b) �

subject to subsection (2) , if the data user cannot comply with the request without disclosing personal data of which any other individual is the data subject unless the data user is satisfied that the other individual has consented to the disclosure of the data to the requestor; or

(c) �

in any other case, if compliance with the request is for the time being prohibited under this Ordinance.

(2)

Subsection (1)(b) shall not operate

(a) �

so that the reference in that subsection to personal data of which any other individual is the data subject includes a reference to information identifying that individual as the source of the personal data to which the data access request concerned relates unless that information names or otherwise explicitly identifies that individual;

(b) �

so as to excuse a data user from complying with the data access request concerned to the extent that the request may be complied with without disclosing the identity of the other individual, whether by the omission of names, or other identifying particulars, or otherwise.

(3)

A data user may refuse to comply with a data access request if

(a) �

the request is not in writing in the Chinese or English language;

Legislative Texts

(b) �

the data user is not supplied with such information as the data user may reasonably require to locate the personal data to which the request relates;

(c) �

the request follows 2 or more similar requests made by

(i) �

the individual who is the data subject in respect of the personal data to which the request relates;

(ii) �

one or more relevant persons on behalf of that individual; or

(iii) any combination of that individual and those relevant persons, and it is unreasonable in all the circumstances for the data user to comply with the request;

(d) �

subject to subsection (4) , any other data user controls the use of the data in such a way as to prohibit the first-mentioned data user from complying (whether in whole or in part) with the request;

(e) �

the form in which the request shall be made has been specified under section 67 and the request is not made in that form; or

(f) �

in any other case, compliance with the request may for the time being be refused under this Ordinance, whether by virtue of an exemption under Part VIII or otherwise.

(4) Subsection (3)(d) shall not operate so as to excuse a data user from complying with the data access request concerned

(a) �

in so far as the request relates to section 18(1)(a) , to any extent;

(b) �

in so far as the request relates to section 18(1)(b) , to any extent that the data user can comply with the request without contravening the prohibition concerned.

(Enacted 1995)

Section 21
�Notification of refusal to comply with data access request
�

(1) Subject to subsection (2) , a data user who pursuant to section 20 refuses to comply with a data access request shall, as soon as practicable but, in any case, not later than 40 days after receiving the request, by notice in writing inform the requestor

(a) �

of the refusal;

(b) �

subject to subsection (2) , of the reasons for the refusal; and

(c) �

where section 20(3)(d) is applicable, of the name and address of the other data user concerned.

(2)

Where

(a) �

a data user has pursuant to section 20 refused to comply with a data access request; and

(b) �

the refusal also relates to section 18(1)(a) by virtue of section 63 ,

then the data user may, in the notice under subsection (1) concerned, in place of the matters of which the data user is required to inform the requestor under that subsection, inform the requestor that the data user has no personal data the existence of which he is required to disclose to the requestor (or words to the like effect).

(Enacted 1995)

Legislative Texts

Section 22
�Data correction request
�

(1)

Subject to subsection (2) , where

(a) �

a copy of personal data has been supplied by a data user in compliance with a data access request; and

(b) �

the individual, or a relevant person on behalf of the individual, who is the data subject considers that the data are inaccurate,

then that individual or relevant person, as the case may be, may make a request that the data user make the necessary correction to the data.

(2)

A data user who, in relation to personal data

(a) �

does not hold the data; but

(b) �

controls the processing of the data in such a way as to prohibit the data user who does hold the data from complying (whether in whole or in part) with section 23(1) in relation to a data correction request which relates to the data,

shall be deemed to be a data user to whom such a request may be made, and the provisions of this Ordinance (including subsection (1) ) shall be construed accordingly.

(3) Without prejudice to the generality of sections 23(1)(c) and 25(2) , if a data user, subsequent to the receipt of a data correction request but before complying with the request pursuant to section 24 or refusing to comply with the request pursuant to section 25 , discloses to a third party the personal data to which the request relates, then the user shall take all practicable steps to advise the third party that the data are the subject of a data correction request still under consideration by the user (or words to the like effect).

(Enacted 1995)

Section 23
�Compliance with data correction request
�

(1) Subject to subsection (2) and section 24 , a data user who is satisfied that personal data to which a data correction request relates are inaccurate shall, not later than 40 days after receiving the request

(a) �

make the necessary correction to those data;

(b) �

supply the requestor with a copy of those data as so corrected; and

(c) �

subject to subsection (3) , if

(i) �

those data have been disclosed to a third party during the 12 months immediately preceding the day on which the correction is made; and

(ii) �

the data user has no reason to believe that the third party has ceased using those data for the purpose (including any directly related purpose) for which the data were disclosed to the third party,

take all practicable steps to supply the third party with a copy of those data as so corrected accompanied by a notice in writing stating the reasons for the correction.

Legislative Texts

(2)

A data user who is unable to comply with subsection (1) in relation to a data correction request within the period specified in that subsection shall

(a) �

before the expiration of that period

(i) �

by notice in writing inform the requestor that the data user is so unable and of the reasons why the data user is so unable; and

(ii) �

comply with that subsection to the extent, if any, that the data user is able to comply with that subsection; and

(b) �

as soon as practicable after the expiration of that period, comply or fully comply, as the case may be, with that subsection.

(3)

A data user is not required to comply with subsection (1)(c) in any case where the disclosure concerned of the personal data to the third party consists of the third party’s inspection of a register or other like document

(a) �

in which the data are entered or otherwise recorded; and

(b) �

which is available for inspection by the public,

but this subsection shall not apply if the third party has been supplied with a copy, certified by or under the authority of the data user to be correct, of the data.

(Enacted 1995)

Section 24
�Circumstances in which data user shall or may refuse to comply with data
�correction request
�

(1)

Subject to subsection (2) , a data user shall refuse to comply with section 23(1) in relation to a data correction request if the data user is not supplied with such information as the data user may reasonably require

(a) �

in order to satisfy the data user as to the identity of the requestor;

(b) �

where the requestor purports to be a relevant person, in order to satisfy the data user

(i) �

as to the identity of the individual in relation to whom the requestor purports to be such a person; and

(ii) �

that the requestor is such a person in relation to that individual.

(2)

Subsection (1) shall not apply to a data correction request where the requestor is the same person as the requestor in respect of the data access request which gave rise to the data correction request.

(3)

A data user may refuse to comply with section 23(1) in relation to a data correction request if

(a) �

the request is not in writing in the Chinese or English language;

(b) �

the data user is not satisfied that the personal data to which the request relates are inaccurate;

(c) �

the data user is not supplied with such information as the data user may reasonably require to ascertain in what way the personal data to which the request relates are inaccurate;

Legislative Texts

(d) �

the data user is not satisfied that the correction which is the subject of the request is accurate; or

(e) �

subject to subsection (4) , any other data user controls the processing of the personal data to which the request relates in such a way as to prohibit the first-mentioned data user from complying (whether in whole or in part) with that section.

(4) Subsection (3)(e) shall not operate so as to excuse a data user from complying with section 23(1) in relation to the data correction request concerned to the extent that the data user can comply with that section without contravening the prohibition concerned.

(Enacted 1995)

Section 25
�Notification of refusal to comply with data correction request, etc.
�

(1) A data user who pursuant to section 24 refuses to comply with section 23(1) in relation to a data correction request shall, as soon as practicable but, in any case, not later than 40 days after receiving the request, by notice in writing inform the requestor

(a) �

of the refusal and the reasons for the refusal; and

(b) �

where section 24(3)(e) is applicable, of the name and address of the other data user concerned.

(2)

Without prejudice to the generality of subsection (1) , where

(a) �

the personal data to which a data correction request relates are an expression of opinion; and

(b) �

the data user concerned is not satisfied that the opinion is inaccurate,

then the data user shall

(i) �

make a note, whether annexed to that data or elsewhere

(A) �

of the matters in respect of which the opinion is considered by the requestor to be inaccurate; and

(B) �

in such a way that those data cannot be used by a person (including the data user and a third party) without the note being drawn to the attention of, and being available for inspection by, that person; and

(ii) �

attach a copy of the note to the notice referred to in subsection (1) which relates to that request.

(3)

In this section, “expression of opinion” includes an assertion of fact which

(a) �

is unverifiable; or

(b) �

in all the circumstances of the case, is not practicable to verify.

(Enacted 1995)

Section 26
�Erasure of personal data no longer required
�

Legislative Texts

(1) A data user shall erase personal data held by the data user where the data are no longer required for the purpose (including any directly related purpose) for which the data were used unless

(a) �

any such erasure is prohibited under any law; or

(b) �

it is in the public interest (including historical interest) for the data not to be erased.

(2)

For the avoidance of doubt, it is hereby declared that

(a) �

a data user shall erase personal data in accordance with subsection (1) notwithstanding that any other data user controls (whether in whole or in part) the processing of the data;

(b) �

the first-mentioned data user shall not be liable in an action for damages at the suit of the second-mentioned data user in respect of any such erasure.

(Enacted 1995)

Section 27
�Log book to be kept by data user
�

(1)

A data user shall keep and maintain a log book

(a) �

for the purposes of this Part;

(b) �

in the Chinese or English language; and

(c) �

such that any particulars entered in the log book pursuant to this section are not erased therefrom before the expiration of

(i) �

subject to subparagraph (ii) , 4 years after the day on which they were so entered;

(ii) �

such longer or shorter period as may be prescribed, either generally or in any particular case, by regulations made under section 70 .

(2)

A data user shall in accordance with subsection (3) enter in the log book

(a) �

where pursuant to section 20 the data user refuses to comply with a data access request, particulars of the reasons for the refusal;

(b) �

where pursuant to section 21(2) the data user does not comply with section 21(1) , particulars of the prejudice that would be caused to the interest protected by the exemption concerned under Part VIII if the existence or non-existence of the personal data to which the data access request concerned relates were disclosed;

(c) �

where pursuant to section 24 the data user refuses to comply with section 23(1) in relation to a data correction request, particulars of the reasons for the refusal;

(d) �

any other particulars required by regulations made under section 70 to be entered in the log book.

(3) The particulars required by subsection (2) to be entered by a data user in the log book shall be so entered

(a) �in the case of particulars referred to in paragraph (a) of that subsection, on or before the notice under section 21(1) is served in respect of the refusal to which those particulars relate;

Legislative Texts

(b) �

in the case of particulars referred to in paragraph (b) of that subsection, on or before the notice under section 21(1) is served in respect of the refusal to which those particulars relate;

(c) �

in the case of particulars referred to in paragraph (c) of that subsection, on or before the notice under section 25(1) is served in respect of the refusal to which those particulars relate;

(d) �

in the case of particulars referred to in paragraph (d) of that subsection, within the period specified in regulations made under section 70 in respect of those particulars.

(4)

A data user shall

(a) �

permit the Commissioner to inspect and copy the log book (or any part thereof) at any reasonable time; and

(b) �

without charge, afford the Commissioner such facilities and assistance as the Commissioner may reasonably require for the purposes of such inspection and copying.

(Enacted 1995)

Section 28
�Imposition of fees by data user
�

(1)

A data user shall not impose a fee for complying or refusing to comply with a data access request or data correction request unless the imposition of the fee is expressly permitted by this section.

(2)

Subject to subsections (3) and (4) , a data user may impose a fee for complying with a data access request.

(3) No fee imposed for complying with a data access request shall be excessive.

(4)

Where pursuant to section 19(3)(c)(iv) or (v) or (4)(ii)(B)(II) a data user may comply with a data access request by supplying a copy of the personal data to which the request relates in one of 2 or more forms, the data user shall not, and irrespective of the form in which the data user complies with the request, impose a fee for complying with the request which is higher than the lowest fee the data user imposes for complying with the request in any of those forms.

(5)

A data user may refuse to comply with a data access request unless and until any fee imposed by the data user for complying with the request has been paid.

(6)

Where

(a) �

a data user has complied with a data access request by supplying a copy of the personal data to which the request relates; and

(b) �

the data subject, or a relevant person on behalf of the data subject, requests the data user to supply a further copy of those data,

then the data user may, and notwithstanding the fee, if any, that the data user imposed for complying with that data access request, impose a fee for supplying that further copy which is not more than the administrative and other costs incurred by the data user in supplying that further copy.

(Enacted 1995)

Legislative Texts

Section 29
�Service and language of certain notices
�

Without prejudice to the generality of section 68 , where pursuant to a data access request or data correction request a data user is required to, or may, inform a requestor of any matter by notice in writing, then the requestor shall be deemed not to be so informed unless and until the requestor is served with the notice

(a) �

in the language in which the request is made if that language is Chinese or English;

(b) �

in any other case, in the Chinese or English language as the data user thinks fit. (Enacted 1995)

Section 44
�Evidence
�

Remarks:

Amendments retroactively made-see 25 of 1998 s. 2

(1) Subject to subsection (2) and section 45 , the Commissioner may, for the purposes of any investigation, summon before him any person who

(a) �

in the opinion of the Commissioner, is able to give any information relevant to those purposes;

(b) �

where the investigation was initiated by a complaint, is the complainant (or, if the complainant is a relevant person, the individual in respect of whom the complainant is such a person, or both),

and may examine any such person and require him to furnish to the Commissioner any information and to produce any document or thing which, in the opinion of the Commissioner, is relevant to those purposes and which may be in the possession or under the control of any such person.

(2)

Where

(a) �

an investigation has been initiated by a complaint;

(b) �

the complaint relates, whether in whole or in part, to personal data referred to in section 61(1) ;

(c) �

the Commissioner has, for the purposes of that investigation, under subsection (1)(a) summoned before him a person; and

Legislative Texts

(d)

that person asserts, in response to any requirement under subsection (1) by the Commissioner to furnish him with information or to produce a document or thing, that

(3)

Where

(a) �

a person has complied with a requirement referred to in subsection (2)(d) the subject of an assertion referred to in that subsection; and

(b) �

the result (whether in whole or in part) of the investigation to which that requirement relates is that the Commissioner is of the opinion that the individual concerned referred to in subsection (2)(d)(i) has not contravened a requirement under this Ordinance in relation to the matter the subject of the complaint which initiated the investigation,

then, notwithstanding any other provision of this Ordinance, neither the Commissioner nor any prescribed officer shall disclose the identity of that individual to the complainant.

Legislative Texts

(4)

The Court of First Instance may, of its own volition or on an application made to it for the purpose, by order reverse, vary or discharge an order made under subsection (2)(iii) or suspend the operation of such an order. (Amended 25 of 1998 s. 2)

(5)

Provision may be made by rules of court

(a) �

with respect to applications to the Court of First Instance under subsection (2)(iii) or (4) ;

(b) �

generally with respect to procedure before the Court of First Instance in relation to any such application. (Amended 25 of 1998 s. 2)

(6)

Subsection (5) is without prejudice to the generality of any existing power to make rules.

(7)

The Commissioner may administer an oath for the purposes of an examination under subsection (1) if he thinks fit.

(8)

It is hereby declared that

(a) �

no obligation to maintain secrecy or other restriction, imposed by law, upon the disclosure of any information, document or other thing, that is or has been in the possession or under the control of any person referred to in subsection (1) , shall apply to its disclosure for the purposes of an investigation; and

(b) �

any requirement by the Commissioner that any such information, document or thing as is referred to in paragraph (a) be disclosed or produced for the purposes of an investigation shall be sufficient authority for its disclosure or production to the Commissioner.

(9)

The Commissioner may pay the reasonable expenses of complainants (including, if the complainant is a relevant person, the individual in respect of whom the complainant is such a person) and witnesses incurred during the course of an investigation.

(Enacted 1995)

Section 45
�Protection of witnesses, etc.
�

Remarks:

Adaptation amendments retroactively made - see 25 of 1998 s. 2; 34 of 1999 s. 3

(1)

Every person shall have the same privileges in relation to the giving of information, the answering of questions, and the production of documents and things, for the purposes of an investigation, as witnesses have in civil proceedings in the High Court but any rule of law which authorizes or requires the withholding of any document or thing, or the refusal to answer any question, on the ground that the disclosure of the document or thing or the answering of the question, as the case may be, would be injurious to the public interest, shall not apply in respect of any investigation. (Amended 25 of 1998 s. 2)

(2)

Except on the trial of any person for perjury in respect of his sworn testimony, or for an offence under this Ordinance, no statement made or answer given by that or any other person in the course of any investigation shall be admissible in evidence against any person, before any magistrate or in any court or at any inquiry or in any other proceedings, and no evidence in respect of an investigation shall be given against any person.

Legislative Texts

(3) Where the giving of any information or the answering of any question or the production of any document or thing would involve the disclosure, without the consent of the Chief Executive, of the deliberations of the Executive Council, the Commissioner shall not require the information or answer to be given or, as the case may be, the document or thing to be produced. (Amended 34 of 1999 s. 3)

(Enacted 1995)

Section 46
�Commissioner, etc. to maintain secrecy
�

(1)

Subject to subsections (2) and (3) , the Commissioner and every prescribed officer shall maintain secrecy in respect of all matters that come to their actual knowledge in the performance of their functions and the exercise of their powers under this Part.

(2)

Subsection (1) shall not operate so as to prevent the Commissioner or any prescribed officer from

(a) �disclosing in the course of proceedings

(i) �

for an offence under this Ordinance; and

(ii) �

before any court or magistrate,

any matter relevant to those proceedings;

(b) �

reporting evidence of any crime to such authority as he considers appropriate;

(c) �

disclosing to a person any matter referred to in subsection (1) which, in the opinion of the Commissioner or prescribed officer, may be ground for a complaint by that person.

(3)

Subject to subsection (4) , the Commissioner may disclose in any report made by him under this Ordinance any matter that in his opinion ought to be disclosed in order to establish grounds for his findings and recommendations other than a matter the disclosure of which in his opinion would involve the disclosure of personal data that are exempt from data protection principle 6 by virtue of an exemption under Part VIII .

(4)

The Commissioner shall not publish a report under this Ordinance after completing an inspection or investigation unless

(a) �

a copy of the report in the form in which it is to be published has been supplied to the relevant data user;

(b) �

that copy is accompanied by a notice in writing inviting the data user to advise the Commissioner, in writing and not later than 28 days after being served with the copy, whether

(i) �

in the opinion of the data user there is any matter in the copy the disclosure of which would involve the disclosure of personal data that are exempt from the provisions of data protection principle 6 by virtue of an exemption under Part VIII ; and

(ii) �

the data user objects to the disclosure of the matter; and

(c) �

either

(i) �the period referred to in paragraph (b) has expired without the Commissioner receiving any such advice; or

Legislative Texts

(ii) �

such advice is received by the Commissioner and

(A) �

the Commissioner deletes from the report the matter the subject of the advice; or

(B) �

the Commissioner decides not to delete that matter from the report and

(I) �

the period referred to in subsection (6) expires without the data user making an appeal under that subsection against that decision; or

(II) �

such an appeal is unsuccessful or withdrawn.

(5)

Where the Commissioner makes a decision referred to in subsection (4)(c)(ii)(B) , he shall serve on the relevant data user who gave the advice concerned a notice in writing

(a) �

stating his decision;

(b) �

informing the data user that he may appeal under subsection (6) against that decision; and

(c) �

accompanied by a copy of this section.

(6)

An appeal may be made to the Administrative Appeals Board against a decision of the Commissioner referred to in subsection (4)(c)(ii)(B) by the relevant data user not later than 14 days after the notice under subsection (5) stating that decision has been served on the data user.

(Enacted 1995)

Section 47
�Persons to be informed of result of inspection or investigation
�

(1)

Where the Commissioner has completed an inspection, he shall, in such manner and at such time as he thinks fit, inform the relevant data user of

(a) �

the result of the inspection;

(b) �

any recommendations arising from the inspection that the Commissioner thinks fit to make relating to the promotion of compliance with the provisions of this Ordinance, in particular the data protection principles, by the data user;

(c) �

any report arising from the inspection that he proposes to publish under section 48 ; and

(d) �

such other comments arising from the inspection as he thinks fit to make.

(2)

Where the Commissioner has completed an investigation, he shall, in such manner and at such times as he thinks fit, inform the relevant data user of

(a) �

the result of the investigation;

(b) �

any recommendations arising from the investigation that the Commissioner thinks fit to make relating to the promotion of compliance with the provisions of this Ordinance, in particular the data protection principles, by the data user;

(c) �

any report arising from the investigation that he proposes to publish under section 48 ;

(d) �

whether or not he proposes to serve an enforcement notice on the data user in consequence of the investigation; and

(e) �

such other comments arising from the investigation as he thinks fit to make.

Legislative Texts

(3)

Where the Commissioner has completed an investigation initiated by a complaint, he shall, in such manner and at such time as he thinks fit, inform the complainant of

(a) �

the result of the investigation;

(b) �

any recommendations made to the relevant data user under subsection (2)(b) ;

(c) �

any report arising from the investigation that he proposes to publish under section 48 ;

(d) �

any comments made by or on behalf of the relevant data user on any such recommendations or report;

(e) �

whether or not he has served, or proposes to serve, an enforcement notice on the relevant data user in consequence of the investigation;

(f) �

if the Commissioner has not so served, and does not propose to so serve, such enforcement notice, his right to object thereto under subsection (4) ; and

(g) �

such other comments arising from the investigation as he thinks fit to make.

(4)

The complainant (or, if the complainant is a relevant person, the individual in respect of whom the complainant is such a person, or either) may appeal to the Administrative Appeals Board against a decision of the Commissioner

(a) �

to the effect that he has not served, and does not propose to serve, an enforcement notice on the relevant data user in consequence of the investigation concerned; and

(b) �

of which the complainant was informed in the notice concerned under subsection (3) served on him.

(Enacted 1995)

Section 48
�Reports by Commissioner
�

(1)

Subject to subsection (3) , the Commissioner may, after completing an inspection where section 36(b) is applicable, publish a report

(a) �

setting out any recommendations arising from the inspection that the Commissioner thinks fit to make relating to the promotion of compliance with the provisions of this Ordinance, in particular the data protection principles, by the class of data users to which the relevant data user belongs; and

(b) �

in such manner as he thinks fit.

(2)

Subject to subsection (3) , the Commissioner may, after completing an investigation and if he is of the opinion that it is in the public interest to do so, publish a report

(a) �

setting out

(i) �

the result of the investigation;

(ii) �

any recommendations arising from the investigation that the Commissioner thinks fit to make relating to the promotion of compliance with the provisions of this Ordinance, in particular the data protection principles, by the class of data users to which the relevant data user belongs; and

(iii) �such other comments arising from the investigation as he thinks fit to make; and

(b) �

in such manner as he thinks fit.

Legislative Texts

(3) Subject to subsection (4) , a report published under subsection (1) or (2) shall be so framed as to the prevent the identity of any individual being ascertained from it.

(4)

Subsection (3) shall not apply to any individual who is

(a) �

the Commissioner or a prescribed officer;

(b) �

the relevant data user.

(Enacted 1995)

Section 49
�Cases in which sections 47 and 48 shall not apply
�

Where

(a) �

the Commissioner has completed an investigation (and whether or not the investigation was initiated by a complaint);

(b) �

the result of the investigation is that the act or practice the subject of the investigation is not a contravention of a requirement under this Ordinance because of an exemption under Part VIII ; and

(c) �

the interest protected by that exemption would be likely to be prejudiced if sections 47 and 48 applied in relation to the investigation,

then

(i) �

those sections shall not apply in relation to the investigation; and

(ii) �

the Commissioner shall, in such manner and at such time as he thinks fit

(A) �

inform the relevant data user of the result of the investigation and such other comments arising from the investigation as he thinks fit;

(B) �

if the investigation was initiated by a complaint, inform the complainant that the result of the investigation is that he is satisfied that the act or practice the subject of the investigation is not a contravention of a requirement under this Ordinance (or words to the like effect).

(Enacted 1995)

Section 50
�Enforcement notices
�

(1) Where, following the completion of an investigation, the Commissioner is of the opinion that the relevant data user

(a) �

is contravening a requirement under this Ordinance; or

(b) �

has contravened such a requirement in circumstances that make it likely that the contravention will continue or be repeated,

then the Commissioner may serve on the relevant data user a notice in writing

(i) �stating that he is of that opinion;

Legislative Texts

(ii) �specifying the requirement as to which he is of that opinion and the reasons why he is of that opinion;

(iii) �directing the data user to take such steps as are specified in the notice to remedy the contravention or, as the case may be, the matters occasioning it within such period (ending not earlier than the period specified in subsection (7) within which an appeal against the notice may be made) as is specified in the notice; and

(iv) �accompanied by a copy of this section.

(2)

In deciding whether to serve an enforcement notice the Commissioner shall consider whether the contravention or matter to which the notice relates has caused or is likely to cause damage or distress to any individual who is the data subject of any personal data to which the contravention or matter, as the case may be, relates.

(3)

The steps specified in an enforcement notice to remedy any contravention or matter to which the notice relates may be framed

(a) �

to any extent by reference to any approved code of practice;

(b) �

so as to afford the relevant data user a choice between different ways of remedying the contravention or matter, as the case may be.

(4)

Subject to subsection (5) , the period specified in an enforcement notice for taking the steps specified in it shall not expire before the end of the period specified in subsection (7) within which an appeal against the notice may be made and, if such an appeal is made, those steps need not be taken pending the determination or withdrawal of the appeal.

(5)

If the Commissioner is of the opinion that by reason of special circumstances the steps specified in an enforcement notice should be taken as a matter of urgency

(a) �

he may include a statement to that effect in the notice together with the reasons why he is of that opinion;

(b) �

where such a statement is so included, subsection (4) shall not apply but the notice shall not require those steps to be taken before the end of the period of 7 days beginning with the date on which the notice was served.

(6)

The Commissioner may cancel an enforcement notice by notice in writing served on the relevant data user.

(7)

An appeal may be made to the Administrative Appeals Board against an enforcement notice by the relevant data user not later than 14 days after the notice was served.

(8)

Where the Commissioner

(a) �

forms an opinion referred to in subsection (1) in respect of the relevant data user at any time before the completion of an investigation; and

(b) �

is also of the opinion that, by reason of special circumstances, an enforcement notice should be served on the relevant data user as a matter of urgency,

he may so serve such notice notwithstanding that the investigation has not been completed and, in any such case

(i) �the Commissioner shall, without prejudice to any other matters to be included in such notice, specify in the notice the reasons as to why he is of the opinion referred to in paragraph (b) ; and

Legislative Texts

(ii) �the other provisions of this Ordinance (including this section) shall be construed accordingly.

(Enacted 1995)

Section 61 News

(1)

Personal data held by a data user

(a) �

whose business, or part of whose business, consists of a news activity; and

(b) �

solely for the purpose of that activity (or any directly related activity), are exempt from the provisions of

(i) �

data protection principle 6 and sections 18(1)(b) and 38(i) unless and until the data are published or broadcast (wherever and by whatever means);

(ii) �

sections 36 and 38(b) .

(2) Personal data are exempt from the provisions of data protection principle 3 in any case in which

(a) �the use of the data consists of disclosing the data to a data user referred to in subsection (1) ; and

Legislative Texts

(b) �

such disclosure is made by a person who has reasonable grounds to believe (and reasonably believes) that the publishing or broadcasting (wherever and by whatever means) of the data (and whether or not they are published or broadcast) is in the public interest.

(3)

In this section“news activity” means any journalistic activity and includes

(a) �

the

(i) �

gathering of news;

(ii) �

preparation or compiling of articles or programmes concerning news; or

(iii) �observations on news or current affairs, for the purpose of dissemination to the public; or

(b) �

the dissemination to the public of

(i) �

any article or programme of or concerning news; or

(ii) �

observations on news or current affairs. (Enacted 1995)

Section 62
�Statistics and research
�

Personal data are exempt from the provisions of data protection principle 3 where

(a) �

the data are to be used for preparing statistics or carrying out research;

(b) �

the data are not to be used for any other purpose; and

(c) �

the resulting statistics or results of the research are not made available in a form which identifies the data subjects or any of them.

(Enacted 1995)

Section 63
�Exemption from section 18(1)(a)
�

Where a data access request relates to personal data which are or, if the data existed, would be exempt from section 18(1)(b) by virtue of section 57 or 58 , then the data are also exempt from section 18(1)(a) if the interest protected by that exemption would be likely to be prejudiced by the disclosure of the existence or non-existence of those data.

(Enacted 1995)