Privacy Commissioner comments on news reports on a compliance check

1. The local newspapers reported today (19 July 2011) the comments made by the principal of a secondary school regarding the inquiries initiated by the Office of the Privacy Commissioner for Personal Data (“PCPD”) on the scheme of voluntary drug testing carried out by the school for its students (“the Scheme”). The principal commented that the PCPD inquiries were unduly interfering and PCPD should provide specific guidance for the Scheme. In response, the Privacy Commissioner Mr. Allan Chiang confirmed a compliance check was being conducted in respect of the Scheme and made the following remarks.

 

2. “To fulfil the mission of the PCPD to protect the privacy of individuals in relation to personal data, we investigate into complaints about contraventions of the requirements under the Personal Data (Privacy) Ordinance (“the Ordinance”).  We also carry out proactively compliance checks on personal data practices to ascertain information from the data users so as to promote compliance with the requirements under the Ordinance.  From 1 April 2010 to 31 March 2011, PCPD has completed 97 such compliance checks and in the overwhelming majority of these cases, the data users have been very cooperative as they appreciate the importance of personal data protection and the value of compliance checks to them.  In most cases, the data users benefited from the process and where necessary took immediate action to improve their personal data practices.”  Mr. Chiang said.

 

3. “If the organisational data user truly respects personal data protection as a fundamental human right, this should be incorporated as an integral part of its corporate governance rather than treated as an administrative burden.  As such, privacy measures should have been built into its organisational practices and business processes from their design stage to execution stage.  Accordingly, it should be able to provide ready answers to PCPD’s inquiries in a compliance check.”

 

4. “We spare no effort in providing general guidance to data users in relation to compliance with the requirements under the Ordinance. This takes various forms like guidance notes, information leaflets, online self-learning lessons, workshops and seminars.  In particular, we give seminars on personal data protection for principals and teachers of secondary schools in connection with drug testing in schools.  Due to resource constraints and a potential conflict with our enforcement role, we are unable to provide specific guidance for individual projects.  Observing personal data privacy and formulating policies in this regard must remain the responsibility of individual organisational data users.”

 

5. “Voluntary drug testing is a relatively new activity in Hong Kong. We do not rule out that in future there is a need for us to issue a general guidance note on voluntary drug testing schemes based on popular demand and accumulated experience. At this stage, the school concerned has yet to reply in full to our inquiries on the Scheme. Not until this has been received will we be able to ascertain the compliance situation in the school and where appropriate offer any meaningful advice,” Mr. Chiang concluded.

 END