PCPD - The Ordinance (Full Text)

Privacy Guidelines: Monitoring and Personal Data Personal Data Privacy at Work

The Ordinance
The Ordinance (Full Text)

CHAPTER 486
PERSONAL DATA (PRIVACY) ORDINANCE

Part V - ACCESS TO AND CORRECTION OF PERSONAL DATA

19. Compliance with data access request

(1)

Subject to subsection (2) and sections 20 and 28(5), a data user shall comply with a data access request not later than 40 days after receiving the request.

(2)

A data user who is unable to comply with a data access request within the period specified in subsection (1) shall-

(a)	before the expiration of that period- by notice in writing inform the requestor that the data user is so unable and of the reasons why the data user is so unable; and comply with the request to the extent, if any, that the data user is able to comply with the request; and

(b)	as soon as practicable after the expiration of that period, comply or fully comply, as the case may be, with the request.

(3)

A copy of the personal data to be supplied by a data user in compliance with a data access request shall-

(a)

be supplied by reference to the data at the time when the request is received except that the copy may take account of-

any processing of the data-
(A) made between that time and the time when the copy is supplied; and
(B) that would have been made irrespective of the receipt of the request; and
subject to subsection (5), any correction to the data made between that time and the time when the copy is supplied;

(b)

where any correction referred to paragraph (a)(ii) has been made to the data, be accompanied by a notice stating that the data have been corrected pursuant to that paragraph (or words to the like effect); and

(c)

as far as practicable, be-

intelligible unless the copy is a true copy of a document which-
(A) contains the data; and
(B) is unintelligible on its face;

readily comprehensible with any codes used by the data user adequately explained; and

in-
(A) subject to sub-subparagraph (B), the language specified in the request or, if no language is so specified, the language in which the request is made (which may be the Chinese or English language in either case);
(B) a language other than the language specified in the request or, if no language is so specified, the language in which the request is made, if, but only if-

(I)	the language in which the data are held is not the language specified in the request or, if no language is so specified, the language in which the request is made, as the case may be; and
(II)	subject to section 20(2)(b), the copy is a true copy of a document which contains the data;

without prejudice to the generality of subparagraph (iii) but subject to subsection (4), be in the form, or one of the forms, if any, specified in the request;

where subparagraph (iv) is not applicable, in such form as the data user thinks fit.