Year Ender 2007 of the PCPD

The Privacy Commissioner for Personal Data, Mr. Roderick B. Woo announced today (19 February) the major work accomplished by the PCPD in 2007 as follows:

1.    Complaint cases

From January to December 2007, 937 complaint cases were received, a decrease of 8.6% over the same period last year, when 1,025 cases were received.  In these complaints, 690 cases were against private sector, 117 against public sector and 130 against individuals.  Regarding complaints against private sector, telecommunications received the highest number of complaints (136 cases) and followed by banking & finance (114 cases) and property management (79 cases).  However, when compared with the figures of 2006, there was a decrease in the number of complaints against these three kinds of industry (telecommunication: 172 cases; banking & finance: 125 cases; property management: 87 cases).

With regard to the nature of complaints, the highest number of complaints was related to the use of personal data without the consent of data subjects (839 cases), while complaints about collection of data & purpose (283 cases) and about data security (109 cases) ranked the second and the third places respectively.

In 2007, the PCPD completed investigation of 921 cases.  Of which, 26 cases were resolved by formal investigation; 128 cases were resolved by mediation; 171 cases were withdrawn/ unresolved; 419 cases lacked prima facie evidence; 84 cases were unsubstantiated, and the remaining 93 cases were out of jurisdiction.

In 2007, the Commissioner issued a total of 14 enforcement notices, directing the data users concerned to take specified steps to remedy the contraventions.  Moreover, 61 warning notices were issued and 8 cases were referred to other law enforcement agency for prosecution.

2.    Conviction cases

In 2007, there were 3 cases convicted of contravening the Personal Data (Privacy) Ordinance (“the Ordinance”).  All of them were related to improper use of personal data for direct marketing.  The companies convicted, including a telecommunications company, a magazine marketing company and a credit card company, were imposed a fine of $14,000, $6,000 and $7,000 respectively.

3.    Enquiry cases and compliance checks

In 2007, the PCPD received a total of 13,170 enquiry cases, about a decrease of 10% over the same period last year, when 14,614 cases were received.  Major issues of enquiries involved data access requests, collection of ID card numbers or copies, and employee monitoring.  In the year, 86 compliance checks were carried out to review the practices of data users alleged of contravening the Ordinance.