Report: Tutorial Centre Using a Student's Results Notice for Promotion
without the Student's Consent
1. After the release of public examination results,
some tutorial centres will publish the results notices of their
students in advertisements in order to attract more candidates to
enroll in their courses. A results notice contains important
personal data of a candidate, such as name, grades, attending school,
identity card number, etc.
of Investigation Report
2. The Privacy Commissioner for Personal Data ("the
Commissioner") Mr. Roderick B. Woo published today (3 August) a
report ("the Report") on the result of an investigation of a complaint
case carried out pursuant to section 38(a) of the Personal Data
(Privacy) Ordinance ("the Ordinance"). The case concerned a
tutorial centre ("the Tutorial Centre") that used the HKCEE results
notice ("the Notice") of the complainant for advertisement and
promotion purposes without the complainant's consent.
3. The complainant was a candidate of the Hong Kong
Certificate of Education Examination ("HKCEE") who took a HKCEE English
course at the Tutorial Centre from March 2006 to April 2007.
After the release of the 2007 HKCEE results, the staff of the Tutorial
Centre inquired the complainant by phone about her HKCEE results.
When the staff learnt of the complainant's excellent performance in
English, the complainant was informed that she could receive an award
of HK$2,000. The complainant then went to the office of the
Tutorial Centre to receive the award and attend a magazine's
interview. At the request of the Tutorial Centre, the complainant
presented the Notice for verification.
4. The complainant later found that the Tutorial
Centre had placed an advertisement in a magazine displaying a copy of
the Notice, a group photo of her and a tutor of the Tutorial Centre,
and a picture drawn by her. The Notice in the advertisement
clearly showed the complainant's name, school name, grades of different
subjects, etc. The complainant complained that the Tutorial
Centre had misused the Notice for advertisement purpose without her
5. According to Data Protection Principle ("DPP") 3
of Schedule 1 to the Ordinance, personal data shall not, without
prescribed consent of the data subject, be used for the purposes other
than the purpose for which they were originally collected or a directly
related purpose. In the course of investigation, the Commissioner
had to first consider whether the publication of the complainant's
personal data in the magazine for advertisement and promotion was
consistent with the original purpose of collecting the data or directly
related to that purpose. If the answer was negative, the
Commissioner had to further consider if the Tutorial Centre had
obtained prior prescribed consent from the Complainant.
6. After consideration of the information obtained
and the circumstances of the case, the Commissioner is of the view that
the act of the Tutorial Centre in publishing the Notice containing the
complainant's personal data for advertisement and promotion without the
complainant's prescribed consent has contravened DPP3. As the
Tutorial Centre's contravention of the requirements of DPP3 will likely
continue or be repeated, the Commissioner served an enforcement notice
pursuant to section 50 of the Ordinance on the Tutorial Centre
directing it to stop publishing results notices containing students'
personal data for promotion, unless the purposes of collecting the data
include such use, or prior prescribed consent has been sought from the
7. Upon receipt of the enforcement notice, the
Tutorial Centre confirmed in writing that it would comply with the
instructions of the enforcement notice and post a notice at its counter
to remind and inform its staff and students that it would not publish
results notices containing students' personal data for promotion,
unless the purposes of collecting the data include such use, or prior
prescribed consent has been sought from the student concerned.
Commissioner's Advice to Tutorial Centres
8. The Commissioner said, "Tutorial centres are urged
to respect students' personal data privacy. It has to be noted
that important personal data of a candidate, e.g. grades, attending
school, identity card number, etc. are shown in a results notice.
If it is necessary to use students' examination results for publicity
purpose, tutorial centres must clearly explain to the students
concerned and their parents in advance what "personal data" will be
used and inform them of the publication details. Moreover,
tutorial centres should not show students' results notices in public to
avoid excessive disclosure of students' personal data and to protect
Commissioner's Advice to Students
9. In addition, the Commissioner would like to remind
students that when tutorial centres enquire about or collect their
examination results, they should take the initiative to find out the
purpose of collecting their personal data and the use of the
data. If students are not willing to disclose their identity and
examination results to the public, they should explicitly inform the
tutorial centres in order to protect their personal data privacy.
10. For details of the case background, relevant
provisions of the Ordinance, findings, the Commissioner's
recommendations and other comments, please refer to the Report.
Copies of the Report can be obtained from the Commissioner's Office at
12/F., 248 Queen's Road East, Wan Chai, Hong Kong. The report is
also available for download from his website (http://www.pcpd.org.hk/english/publications/invest_report.html