Privacy Commissioner amends the Data Access Request Form


1.    The Privacy Commissioner for Personal Data, Mr. Roderick B. Woo publishes an amended Data Access Request Form (the Form) today (4 January) in the Government Gazette.  The Form will be effective on 1 April 2008.

2.    Under section 18 of the Personal Data (Privacy) Ordinance (the Ordinance), an individual has the right to make a request to be informed by a data user, e.g. government department or private organization, whether the data user holds his personal data and to be supplied with a copy of such data.  The data user shall respond not later than 40 days after receiving the request.

3.    Mr. Woo said, "Accessing one's own personal data is the basic right vested in the public by the Ordinance.  In recent years, some decisions and suggestions have been made when the Administrative Appeals Board handled some related cases.  In this regard, I believe that timely amendment to the Data Access Request Form is necessary so that the public and organizations can clearly know the scope of a data access request, as well as their rights and responsibilities."

4.    "Moreover, some enquiries and complaint cases revealed that as some people did not fully understand the content of the Form and could not specify clearly and in detail the particulars requested in the Form, e.g. the personal data being accessed, they were not provided with the personal data requested.  Therefore, when I amended this Form, clarification and explanation were made to encourage people to specify the requested data clearly so as to avoid any delay," said Mr. Woo.

5.    Firstly, a data access request may be refused if it is not made in the new Form.  The Form can be completed in Chinese or English.  Most important of all, the completed Form should be sent directly to the data user concerned, and not to the Privacy Commissioner.

6.    In the past, when completing the Data Access Request Form, some people did not request the data users to confirm if they were holding the personal data requested.  When the data users did not hold the personal data, they had no duty to reply to the requestors; disputes thus arose.  In the new Form, the public should clearly request replies from the data users, no matter they hold the requested data or not.

7.    When completing the new Form, people should specify clearly and in detail the personal data requested, e.g. appraisal reports, medical reports, credit reports, etc.  Too general a description of the requested data, such as "all of my personal data", may make it difficult for the data user to comply with the request.  Moreover, the request may also be refused by the data user pursuant to section 20(3)(b) of the Ordinance because the data user has no duty to make a thorough search for the personal data related to the request if the data user is not supplied with the information reasonably required to locate the data.

8.    Furthermore, the new Form also expressly states the requirement of the Ordinance on the duty of a data user when complying with a data access request.  It extends only to supplying a copy of the personal data of the data subject, and not a copy of the document in which the data is contained.

9.    Mr. Woo said, "Lastly, data users are reminded that they should comply with or refuse to comply with (conditions in section 20 of the Ordinance being satisfied) the data access requests within the 40-day limit.  Failure to do so may constitute an offence and an offender is liable on conviction to a maximum penalty of $10,000 (a fine at level 3) under section 64(10) of the Ordinance.

10.    The new Form will be available for download from the website of the PCPD (www.pcpd.org.hk) on 1 April.  Copies are also available from the office of the PCPD (12/F., 248 Queen’s Road East, Wan Chai, Hong Kong) or various District Offices.


END


Encl.-  Data Access Request Form