Investigation report: University refusing to comply with
data access request in relation to examination marking

1.   The Privacy Commissioner for Personal Data (“the Commissioner”) Mr. Roderick B. Woo published today (19 January) a report (“the Report”) on the result of an investigation of a complaint case carried out pursuant to section 38(a) of the Personal Data (Privacy) Ordinance (“the Ordinance”).  The case concerned the refusal of a university (“the University”) to comply with a data access request (“DAR”) for examination marking of a student (“the Complainant”).

2.    An individual is empowered by the Ordinance to access his personal data held by a data user.  Section 2(1) of the Ordinance defines “personal data” as any data relating to a living individual; being recorded in a form that can be processed or accessed; and from which the identity of the individual can be directly or indirectly ascertained.

3.    Under section 18 of the Ordinance, a data subject has the right to make a request to be informed by a data user whether the data user holds his or her personal data and to be supplied with a copy of such data.  Section 19 of the Ordinance provides that a data user shall comply with a DAR not later than 40 days after receiving the request.  If the data user has reasonable grounds to refuse to comply with the request under the Ordinance, he shall inform the data subject of the reasons for the refusal in writing before the expiration of that period.

4.   The duty of a data user when complying with a DAR only extends to supplying a copy of the personal data of the data subject, and not a copy of the document in which the data are contained.

5.    The case arose from a DAR made to the University by the Complainant for copies of the “examination answers, audio-tapes, coursework (and related comments of the above) on 4 courses” that the Complainant had attended (“the Requested Data”).  In response to the DAR, the University stated that as it was within the period of the appeal process of the Complainant’s request for review of course grades, the University could not look into the Complainant’s DAR to supply the Complainant with the examination answer scripts and coursework, but agreed to provide the Complainant with a copy of the video tape requested by the Complainant.  The Complainant therefore complained that the University had failed to comply with the Complainant’s DAR.

6.    After careful consideration of all the circumstances of the case, the Commissioner was of the view that the University had not complied with the Complainant’s DAR not later than 40 days after receiving the request and contravened the requirements of section 19(1) of the Ordinance.  During the course of the investigation, the University finally provided the Complainant with the Requested Data.

7.   The Commissioner reminded candidates, “The term ‘personal data’ under the Ordinance refers to data from which the identity of a living individual can be ascertained.  I understand that there are occasions especially where a candidate is not satisfied with his examination results, he may wish to have access to his examination scripts, coursework or answer books with scores and examiners’ written remarks contained therein.  However, he may not understand that his examination answers are not necessarily his personal data in respect of which he can make a valid DAR to the education or examination bodies concerned.  In fact, examination papers and answers generally do not constitute personal data of the candidates because they do not refer to their personal information.  For instance, mathematics examination papers and answers only relate to mathematical calculations and do not constitute personal data of the candidates.  Hence, the Ordinance does not empower candidates to request for copies of examination papers and answers from education or examination bodies.”

8.    On the other hand, the Commissioner offered some advice to education and examination bodies in handling DARs, “Personal information of a candidate which are contained in answers, or comments marked on answer books by examiners are personal data of the candidate.  When an education or examination body receives a DAR from a candidate, it should provide the candidate with a copy of the latter’s personal data, but personal data from which the identity of the examiner can be ascertained, e.g. name of the examiner, need to be deleted.  Therefore, education or examination bodies should take care when handling DARs from candidates.

9.    For case background, relevant provisions of the Ordinance, explanations of the University, result of the investigation and comments arising from the investigation, please refer to the Report.  Copies of the Report are available from the Commissioner’s Office at 12/F, 248 Queen's Road East, Wan Chai, Hong Kong.  It is also available for download from the website of the Commissioner's Office   (www.pcpd.org.hk),


END