PCPD - Privacy Commissioner completed preliminary inquiry into IPD incident

The Privacy Commissioner for Personal Data (the Commissioner) Mr. Roderick B. Woo has completed an inquiry into the allegation that personal data related to trademark registration were wrongfully disclosed through the Intellectual Property Department's (IPD) website.

During the course of the inquiry, the Director of Intellectual Property had been cooperative in providing all necessary information as requested by the Commissioner.

Having considered all the circumstances of the case, the Commissioner was of the view that the IPD should not allow uncontrolled access by internet users to personal data online even though the disclosure was intended by IPD to fulfill its statutory duty.

"In my opinion, the disclosure of an individual's personal data to the public without his/her consent is in itself an invasion of his /her privacy. The fact that a particular type of personal data is passively collected through a website does not mean that the personal data should automatically be published on the internet." Mr. Woo said.

As directed by the Commissioner, the Director of Intellectual Property has given a written undertaking to take the following remedial steps inasmuch as they would not be inconsistent with the performance of his statutory duties:-

1)    Not to publish any personal data on the internet enumerated under Rule 69 of the Trade Marks Rules (Cap.559A) without the prescribed consent of the data subject concerned.
2)    Include a privacy policy statement in IPD's website setting out the specified purposes of the information posted on its website and the limitation on subsequent usage of such information.
3)    Formulate and provide a copy of a comprehensive guideline for its employees on the collection, holding, processing and use of personal data for the administration of the Trade Marks Ordinance (Cap.559) and its subsidiary legislation.
4)    Identify all individuals whose personal data had been published on the internet of the Trade Marks Rules (Cap.559A) and take all practical steps to inform them in writing of the following:
   -   The kinds of personal data that had been published on the internet.
   -   The kinds of action that had been taken to remedy the situation.
   -   Their rights to refuse to give consent and to seek civil remedy from IPD.
   -   Contact name and address with IPD for enquiry.

The Director of Intellectual Property has stated that he would implement the above measures before the end of May 2007. The Commissioner will follow up on this matter to ensure full compliance of the undertaking by that date.

The Commissioner has today issued a written warning to the Director of IPD that an enforcement notice would be served on IPD should it fail to abide by the terms of his undertaking or to observe the requirements of the Data Protection Principles (DPP) in Schedule 1 to the Personal Data (Privacy) Ordinance on similar matters in the future.