|
|
|
 |
|
| |
|
CHAPTER 486
PERSONAL DATA (PRIVACY) ORDINANCE
Part VI - MATCHING PROCEDURES AND TRANSFER OF PERSONAL DATA, ETC.
30. Matching procedure
not to be carried out except with consent of data subject,
etc.
| (1) |
A data user shall not carry
out, whether in whole or in part, a matching procedure-
| (a)
|
unless and until each individual who is a data
subject of the personal data the subject of that
procedure has given his prescribed consent to
the procedure being carried out;
|
| |
|
| (b) |
unless and until the Commissioner has consented
under section 32 to the procedure being carried
out;
|
| |
|
| (c) |
unless the procedure-
- belongs to a class of matching procedures
specified in a notice under subsection (2);
and
- is carried out in accordance with the conditions,
if any, specified in the notice; or
|
| |
|
| (d) |
unless it
is required or permitted under any provision of
any Ordinance specified in Schedule 4. |
|
| |
|
| (2) |
For the purposes of this section, the Commissioner
may, by notice in the Gazette, specify-
| (a)
|
a class of matching procedures;
|
| |
|
| (b) |
subject to subsection (3), the conditions, if
any, subject to which a matching procedure belonging
to that class shall be carried out.
|
|
| |
|
| (3) |
The Commissioner shall, before specifying any conditions
in a notice under subsection (2), consult with-
| (a)
|
such bodies representative of data users to which
the conditions will apply (whether in whole or
in part); and
|
| |
|
| (b) |
such other interested persons,
|
as he thinks fit.
|
| |
|
| (4) |
It is hereby declared
that a notice under subsection (2) is subsidiary legislation.
|
| |
|
| (5) |
Subject to subsection (6), a data user shall not take
adverse action against an individual in consequence
(whether in whole or in part) of the carrying out of
a matching procedure-
| (a)
|
unless the data user has served a notice in writing
on the individual-
- specifying the adverse action it proposes
to take and the reasons therefor; and
- stating that the individual has 7 days after
the receipt of the notice within which to show
cause why that action should not be taken; and
|
| |
|
| (b) |
until the expiration of those 7 days.
|
|
| |
|
| (6) |
Subsection (5)
shall not operate to prevent a data user from taking adverse
action against an individual if compliance with the requirements
of that subsection would prejudice any investigation into
the commission of an offence or the possible commission
of an offence. |
Back to top
  
|
|
|
| |
Notice/
Copyright 2001 Office of the Privacy Commissioner for Personal
Data, Hong Kong. All rights reserved. Disclaimer
|
|
