Investigation Report: Tutorial Centre Using a Student's Results Notice for Promotion without the Student's Consent


Introduction
1.    After the release of public examination results, some tutorial centres will publish the results notices of their students in advertisements in order to attract more candidates to enroll in their courses.  A results notice contains important personal data of a candidate, such as name, grades, attending school, identity card number, etc.

Publication of Investigation Report
2.    The Privacy Commissioner for Personal Data ("the Commissioner") Mr. Roderick B. Woo published today (3 August) a report ("the Report") on the result of an investigation of a complaint case carried out pursuant to section 38(a) of the Personal Data (Privacy) Ordinance ("the Ordinance").  The case concerned a tutorial centre ("the Tutorial Centre") that used the HKCEE results notice ("the Notice") of the complainant for advertisement and promotion purposes without the complainant's consent.

The Complaint
3.    The complainant was a candidate of the Hong Kong Certificate of Education Examination ("HKCEE") who took a HKCEE English course at the Tutorial Centre from March 2006 to April 2007.  After the release of the 2007 HKCEE results, the staff of the Tutorial Centre inquired the complainant by phone about her HKCEE results.  When the staff learnt of the complainant's excellent performance in English, the complainant was informed that she could receive an award of HK$2,000.  The complainant then went to the office of the Tutorial Centre to receive the award and attend a magazine's interview.  At the request of the Tutorial Centre, the complainant presented the Notice for verification.

4.    The complainant later found that the Tutorial Centre had placed an advertisement in a magazine displaying a copy of the Notice, a group photo of her and a tutor of the Tutorial Centre, and a picture drawn by her.  The Notice in the advertisement clearly showed the complainant's name, school name, grades of different subjects, etc.  The complainant complained that the Tutorial Centre had misused the Notice for advertisement purpose without her prior consent.

5.    According to Data Protection Principle ("DPP") 3 of Schedule 1 to the Ordinance, personal data shall not, without prescribed consent of the data subject, be used for the purposes other than the purpose for which they were originally collected or a directly related purpose.  In the course of investigation, the Commissioner had to first consider whether the publication of the complainant's personal data in the magazine for advertisement and promotion was consistent with the original purpose of collecting the data or directly related to that purpose.  If the answer was negative, the Commissioner had to further consider if the Tutorial Centre had obtained prior prescribed consent from the Complainant.

Enforcement Notice
6.    After consideration of the information obtained and the circumstances of the case, the Commissioner is of the view that the act of the Tutorial Centre in publishing the Notice containing the complainant's personal data for advertisement and promotion without the complainant's prescribed consent has contravened DPP3.  As the Tutorial Centre's contravention of the requirements of DPP3 will likely continue or be repeated, the Commissioner served an enforcement notice pursuant to section 50 of the Ordinance on the Tutorial Centre directing it to stop publishing results notices containing students' personal data for promotion, unless the purposes of collecting the data include such use, or prior prescribed consent has been sought from the student concerned.

Remedial Measures
7.    Upon receipt of the enforcement notice, the Tutorial Centre confirmed in writing that it would comply with the instructions of the enforcement notice and post a notice at its counter to remind and inform its staff and students that it would not publish results notices containing students' personal data for promotion, unless the purposes of collecting the data include such use, or prior prescribed consent has been sought from the student concerned.

The Commissioner's Advice to Tutorial Centres
8.    The Commissioner said, "Tutorial centres are urged to respect students' personal data privacy.  It has to be noted that important personal data of a candidate, e.g. grades, attending school, identity card number, etc. are shown in a results notice.  If it is necessary to use students' examination results for publicity purpose, tutorial centres must clearly explain to the students concerned and their parents in advance what "personal data" will be used and inform them of the publication details.  Moreover, tutorial centres should not show students' results notices in public to avoid excessive disclosure of students' personal data and to protect their privacy."

The Commissioner's Advice to Students
9.    In addition, the Commissioner would like to remind students that when tutorial centres enquire about or collect their examination results, they should take the initiative to find out the purpose of collecting their personal data and the use of the data.  If students are not willing to disclose their identity and examination results to the public, they should explicitly inform the tutorial centres in order to protect their personal data privacy.

10.    For details of the case background, relevant provisions of the Ordinance, findings, the Commissioner's recommendations and other comments, please refer to the Report.  Copies of the Report can be obtained from the Commissioner's Office at 12/F., 248 Queen's Road East, Wan Chai, Hong Kong.  The report is also available for download from his website (http://www.pcpd.org.hk/english/publications/invest_report.html).



END