Purpose

1. The purpose of this Complaint Handling Policy is:

a) to enable a complainant to understand what specific criteria have to be met in making a complaint under section 37 of the Personal Data (Privacy) Ordinance ("the Ordinance");

b) to bring to the awareness of the relevant parties to a complaint the standard policy of the Office of the Privacy Commissioner for Personal Data ("PCPD") in handling a complaint, to enable them to have a basic understanding and realistic expectation of how their case is to be handled; and

c) in the event of any subsequent appeal to the Administrative Appeals Board, to enable the Board to give regard to such policy in accordance with section 21(2) of the Administrative Appeals Board Ordinance.

2. This Complaint Handling Policy aims at providing a fair, consistent and efficient approach in PCPD's handling of complaints under section 37 of the Ordinance. In particular, it covers the ways in which the Privacy Commissioner for Personal Data ("the Commissioner") normally exercises his powers and discretion under Part VII of the Ordinance, including but not limited to the following:

a) acceptance of a complaint under section 37;

b) discretion under section 39(2) to refuse to carry out or continue an investigation;

c) exercising the general powers of investigation under Part VII;

d) issuing an enforcement notice under section 50; and

e) notifying parties to a complaint the right of appeal against the Commissioner's decision.

The Policy

(A) Acceptance of a complaint under section 37

3. The term "complaint" is defined in the Ordinance as "a complaint under section 37". In summary, a complaint under section 37 must satisfy the following criteria:

a) it is in respect of an act or practice of a data user specified in the complaint, which relates to personal data;

b) the complaint is brought by the individual who is the subject of the data, or by someone else in the capacity of a relevant person of such individual, as defined in the Ordinance; and

c) the act or practice may be a contravention of a requirement under the Ordinance.

4. In practice, the following information has to be provided to the PCPD in making a complaint under section 37:

a) the complainant should provide his/her name and correspondence address for contact. Under section 39(1), the Commissioner may refuse to carry out or continue an investigation initiated by a complaint if the complaint is made anonymously or the complainant cannot be identified or traced;

b) the complainant should provide his/her proof of identity by either producing his/her identification document (such as Hong Kong Identity Card) in person, or by sending copy of the document to the PCPD for verification. In the case where a complaint is lodged by a relevant person as defined under the Ordinance, supporting document or written authorization (as the case may be) has to be produced for verification of their identities and/or authorization;

c) the complainant must specify the identity of the party complained against by providing his name and contact details. Mere provision of the means to trace the identity of party complained against e.g. a website or telephone number without other information to identify the individual is generally not considered as sufficient; and

d) the complainant should produce sufficient information (including witness in some cases) in support of his/her allegation. Mere speculation is insufficient to substantiate a complaint e.g. the mere possession of personal data does not mean that the personal data are collected by unfair means.

5. The PCPD will provide appropriate assistance to an individual to formulate his complaint and seek further information where necessary. Once the criteria for a complaint under section 37 are met, the PCPD will notify the complainant in writing of the acceptance of his/her complaint and specify the date on which the PCPD has received sufficient information from the complainant for satisfying those criteria. Where the criteria for a complaint under section 37 are not satisfied, no investigation will be carried out and the individual will be informed accordingly.

6. However, where the Commissioner has reasonable grounds to believe that there may have been contravention of a requirement of the Ordinance, which involves personal data other than that of the complainant, he may conduct a compliance check against the data user's practice concerned and/or commence an investigation into the matter on his own initiative under paragraphs (b) and (ii) of section 38.

7. In any event, the complainant is encouraged first to raise the matter complained of with the party complained against, as they may be able to resolve the dispute without intervention by the PCPD.

(B) Discretion under section 39(2) to refuse to carry out or continue an investigation

8. Section 39(1) and (2) of the Ordinance contain various grounds on which the Commissioner may exercise his discretion to refuse to carry out or continue an investigation. In applying some of those grounds, the PCPD's policy is as follows:

a) the act or practice specified in a complaint may be considered to be trivial, if the damage (if any) or inconvenience caused to the complainant by such act or practice is seen to be small;

b) the complaint may be considered to be vexatious, if the complainant has habitually and persistently made to the PCPD other complaints against the same or different parties, unless there is seen to be reasonable grounds for making all or most of those complaints;

c) the complaint may be considered to be made not in good faith, if the complaint is seen to be motivated by personal feud or other factors not related to concern for one's privacy.

In addition, an investigation or further investigation may be considered to be unnecessary if:

d) after preliminary enquiry by the PCPD, there is no prima facie evidence of any contravention of the requirements of the Ordinance;

e) the data protection principles are seen to be not engaged at all, in that there has been no collection of personal data. In this connection it is important to note that, according to case law, there is no collection of personal data by a party unless that party is thereby compiling information about an identified person or about a person whom it seeks or intends to identify;

f) the complainant and party complained against are able or should be able to resolve the dispute between them without intervention by the PCPD;

g) given the mediation by the PCPD, remedial action taken by the party complained against or other practical circumstances, the investigation or further investigation of the case cannot be reasonably expected to bring about a more satisfactory result; or

h) the complaint in question or a directly related dispute is currently or soon to be under investigation by another regulatory or law enforcing body.

9. If any of the above grounds a) to h) is satisfied, the Commissioner may, having regard to all the circumstances of the case, exercise his discretion under section 39(2) to refuse to carry out or continue an investigation. The Commissioner shall notify the complainant in writing of his refusal to carry out or continue an investigation and the reasons for the refusal within 45 days after receiving the complaint. For the avoidance of doubt, in calculating the 45-day period, the time will only start to run from the date on which the PCPD has received from the complainant sufficient information to satisfy the criteria of a complaint under section 37, being the date specified in the PCPD's notification to complainant of acceptance of his/her complaint.

(C) Exercising general powers of investigation under Part VII

10. Before the Commissioner invokes his general powers of investigation under Part VII, preliminary enquiries are normally carried out, which may include mediation, to see whether the case can be resolved without a formal investigation. After an investigation has commenced, the powers available to the Commissioner under the various provisions of Part VII include mainly the following:

a) power under section 43(1)(a) to be furnished with any information, document or thing, from such persons, and to make such inquiries, as he may see fit;

b) power under section 44 to summon before him any person and to examine such person; and

c) power under section 43(2) to conduct a hearing.

11. Under section 43(1)(b), the Commissioner may regulate his procedure in such manner as he thinks fit. It is a matter for the discretion of the Commissioner which power or powers under Part VII he may decide to exercise in furtherance of an investigation. Generally speaking, under section 64(9), any person who, without lawful excuse hinders or fails to provide information to the Commissioner in performing his functions, commits an offence.

12. Under section 46(1), the Commissioner and other staff of the PCPD are obliged to maintain secrecy in respect of any information obtained in an investigation. Therefore, while parties will be informed of the general progress and outcome of their case, the PCPD may not be able to accede to a request for specific information (e.g. for a copy of a letter sent to the PCPD by another party) unless consent is obtained from the relevant party.

(D) Issuing an enforcement notice under section 50

13. As the result of an investigation, the Commissioner will have the discretionary power to serve on the party complained against an enforcement notice under section 50(1) if one of the following conditions is satisfied:

a) that party is found to be contravening a requirement of the Ordinance; or

b) that party is found to have contravened such a requirement in circumstances that make it likely that the contravention will be repeated.

14. Where a contravention is found to have occurred but is not continuing, whether the Commissioner considers it likely for the contravention to be repeated in the future may depend on factors including the following:

a) whether the contravention found was a first-time or repeated contravention, accidental or deliberate;

b) whether the party complained against is willing to give a written undertaking to the Commissioner regarding improvement to its future conduct in such form as the Commissioner deems fit; or

c) whether the party complained against has shown remorse during the course of the investigation by co-operating fully with the PCPD, taking appropriate remedial actions, etc.

15. Under section 50(2), in exercising his discretion to serve an enforcement notice, the Commissioner shall consider any damage or distress, or likelihood of such damage or distress, to the complainant. In addition, it is the Commissioner's policy to consider also whether, practically speaking, the serving of an enforcement notice in the circumstances of the case will in fact enable specific steps to be taken to prevent any future repetition of the contravention by the party complained against.

(E) Appeal against the decision of the Commissioner

16. The complainant may appeal to the Administrative Appeals Board against a decision of the Commissioner not to carry out an investigation of his complaint or, if there is an investigation, not to issue an enforcement notice against the relevant data user in consequence of the investigation, in accordance with sections 39(4) and 47(4) of the Ordinance respectively. As required by section 9 of the Administrative Appeals Board Ordinance, the notice of appeal has to be lodged with the Secretary to the Board within 28 days after receiving notice of the Commissioner's decision. On the other hand, where an enforcement notice has been issued by the Commissioner against a data user, the relevant data user may pursuant to section 50(7) of the Ordinance appeal to the Board against the Commissioner's decision of serving an enforcement notice not later than 14 days after the notice was served. Further enquiries about appeal may be made by writing to the Secretary to the Board at Room 321, 3/F, East Wing, Central Government Offices, 2 Tim Mei Avenue, Tamar, Hong Kong or by calling 2810 2092.

The above Policy is for reference only. The PCPD reserves the right to change its Policy from time to time without notification to any parties concerned as circumstances may demand. For ease of reading, some of the provisions of the Ordinance have been summarized or paraphrased in this Complaint Handling Policy. For the precise wording of those provisions, please refer to the Ordinance.

© Office of the Privacy Commissioner for Personal Data, Hong Kong
February 2011 (Third Revision)

Back to top