Whether posting a list of competitors on website is a breach of the Ordinance.

A: Under the Ordinance, posting of such information on the website would be a use of personal data. The use of personal data is subject to the requirements of data protection principle ("DPP") 3 in Schedule 1 to the Ordinance. By virtue of DPP3 personal data shall not, without the "prescribed consent" of the data subject, be used for any purpose other than

(a) the purpose for which the data were to be used at the time of the collection of the data; or

(b) a purpose directly related to the purpose referred to in paragraph (a).

It appears from your enquiry that it was your intention when you collected the personal data of competitors to post certain items on your website. Presumably your purpose in doing this is to enable those involved and other interested parties to ascertain who will be taking part. If so, the posting of the information at your website for this purpose will not contravene the requirements of DPP3.

In case you are not aware of it, DPP1(3) requires that when personal data are collected from the individuals who are the subjects of the data they should be explicitly informed of

(a) the purpose for which the data are to be used;

(b) the classes of person (if any) to whom the data may be transferred; and

(c) the individual rights to request access to and correction of personal data of which they are the subject and to whom to make such requests.

In the case under consideration you should therefore have notified prospective competitors under items (b) that their identities would be made known to parties accessing the relevant page of your website. Apart from the legal requirement to do this under DPP1(3), this would assist in avoiding any later arguments about the basis on which the information concerned was collected.