Notes on Complaint & Enquiry Cases related to DPP4 - security of personal data

Case No.: 1998132	Whether disclosure of results of Teaching Evaluation to students is a contravention of the Ordinance.
Case No.: 1998125	A data user should not issue to any individual any card bearing the ID card number of that individual.
Case No.: 1998106	Whether display on a notice board of the surname and part of the ID card number of an individual is in contravention of the Ordinance.
Case No.: 1997004	Collection of personal data
Case No.: 1997005	Employee resignation notice containing excessive data
Case No.: ar9798-10	Security of personal data used in debt collection
Case No.: 1997014	Collection and security of personal data collected by building managers
Case No.: 1997015	Liability of a principal
Case No.: 1997016	Disclosure of clients' personal data by insurance agent
Case No.: 1997018	Disclosure of sensitive information by a law firm
Case No.: 2001003	Loss of documents when subscribing to a mobile phone service
Case No.: 2001005	Wrongful transmission of subscribers' personal data by fax - DPP4
Case No.: 2002006	Sending documents through a third party
Case No.: 2002007	Service of trial bundle by a solicitor's firm
Case No.: 2002008	Identity card number as default password
Case No.: 1998001	Reading out of unsolicited data of a data subject contained in her letter
Case No.: 2003005	Randomly assigned instead of fixed reset password preferred when reactivating a lockout account
Case No.: 2003006	Prevention of unauthorized or accidental access to password protected customers' personal data
Case No.: 2003007	Personal data collected through outdoor marketing campaigns
Case No.: 1997020	Definition of 'data user'
Case No.: 2004005	Sending information through fax
Case No.: 2003011	Collection of ID card number of visitor by security guard
Case No.: 2005009	Handling of customers' personal data by marketing staff
Case No.: 2005011	Whether the telecommunications company had taken all practicable steps to protect personal data of customers using its online billing system.
Case No.: 2005016	An e-mail is not personal data of a person simply because the name of that person is on the list of recipients
Case No.: 2005018	Inadequate verification procedure to protect customers' personal data against unauthorized access
Case No.: 2007001	Complainant's duty to establish a valid complaint
Case No.: 2007007	Non-compliance with data access request by a university
Case No.: 2006010	Online data leakage of personal data of policyholder of an insurance company
Case No.: 2008005	Whether an e-mail address is personal data.
Case No.: 2009003	A messenger of a law firm requested a receptionist to sign on a copy of a letter addressing to the complainant as acknowledgement of receipt thereby disclosing the complainant's personal data.
Case No.: 2007021	This page only provides Chinese version temporarily
Case No.: 2009101	What are the appropriate steps to be taken by a data user in data loss or leakage incidents
Case No.: 2009009	Whether the preventive measures taken by a telecommunications company were adequate to ensure that the customers' personal data are protected against unauthorized or accidental access