|
|
|
|
 |
|
| |
|
CHAPTER 486
PERSONAL DATA (PRIVACY) ORDINANCE
Part V - ACCESS TO AND CORRECTION
OF PERSONAL DATA
20. Circumstances in which
data user shall or may refuse to comply with data access request
| (1) |
A data user shall refuse
to comply with a data access request-
| (a)
|
if the data user is not supplied with such information
as the data user may reasonably require-
- in order to satisfy the data user as to the
identity of the requestor;
- where the requestor purports to be a relevant
person, in order to satisfy the data user-
(A) as to the identity of the individual in
relation to whom the requestor purports to be
such a person; and
(B) that the requestor is such a person in relation
to that individual;
|
| |
|
| (b) |
subject to subsection (2), if the data user cannot
comply with the request without disclosing personal
data of which any other individual is the data
subject unless the data user is satisfied that
the other individual has consented to the disclosure
of the data to the requestor; or
|
| |
|
| (c) |
in any other
case, if compliance with the request is for the
time being prohibited under this Ordinance. |
|
| |
|
| (2) |
Subsection (I )(b) shall not operate-
| (a)
|
so that the reference in that subsection to personal
data of which any other individual is the data
subject includes a reference to information identifying
that individual as the source of the personal
data to which the data access request concerned
relates unless that information names or otherwise
explicitly identifies that individual;
|
| |
|
| (b) |
so as to excuse a data user from complying with
the data access request concerned to the extent
that the request may be complied with without
disclosing the identity of the other individual,
whether by the omission of names, or other identifying
particulars, or otherwise.
|
|
| |
|
| (3) |
A data user may refuse to comply with a data access
request if-
| (a)
|
the request is not in writing in the Chinese
or English language;
|
| |
|
| (b) |
the data user is not supplied with such information
as the data user may reasonably require to locate
the personal data to which the request relates;
|
| |
|
| (c) |
the request follows 2 or more similar requests
made by-
- the individual who is the data subject in
respect of the personal data to which the request
relates;
- one or more relevant persons on behalf of
that individual; or
- any combination of that individual and those
relevant persons, and it is unreasonable in
all the circumstances for the data user to comply
with the request;
|
| |
|
| (d) |
subject to
subsection (4), any other data user controls the
use of the data in such a way as to prohibit the
first-mentioned data user from complying (whether
in whole or in part) with the request; |
| |
|
| (e) |
the form
in which the request shall be made has been specified
under section 67 and the request is not made in
that form; or |
| |
|
| (f) |
in any other
case, compliance with the request may for the time
being be refused under this Ordinance, whether by
virtue of an exemption under Part VIII or otherwise.
|
|
| |
|
| (4) |
Subsection (3)(d) shall not operate so as to excuse
a data user from complying with the data access request
concerned-
| (a)
|
in so far as the request relates to section 18(1)(a),
to any extent;
|
| |
|
| (b) |
in so far as the request relates to section 18(1)(b),
to any extent that the data user can comply with
the request without contravening the prohibition
concerned.
|
|
Back to top
  
|
|
|
| |
Notice/
Copyright © Office of the Privacy Commissioner for Personal
Data, Hong Kong. All rights reserved. Disclaimer
|
|
