About the Office of the Privacy Commissioner for Personal Data, Hong Kong

What are Personal Data ?

Personal data are recorded information, including expressions of opinion, relating to an identifiable living individual, which are organized in such a way that they can be processed or retrieved. Examples are name, telephone number, address, sex, age, occupation, marital status, salary, financial status, nationality, photo, identity card number, medical and employment records, including assessments of employment performance.

Who is a Data User and a Data Subject?

In the Ordinance, a data user means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data. In practice, a data user could be a company, government department or other public body. Data subject means the individual who is the subject of the data.

Rights to be enjoyed under the Ordinance

• right to fair collection for lawful purpose
  
• right to be informed about intended use
  
• right to give only necessary data
  
• right to withhold consent to change of use
  
• right to accuracy and security
  
• right of access
  
• right of correction
  
• right to openness

How to Lodge a Complaint ?

An individual who wants to lodge a complaint can put it in writing in either Chinese or English, giving his or her name and contact details, identity of the party complained against, and full particulars of the case to the Commissioner's Office. For convenience, this can be done by using the complaint form obtainable from the Commissioner's Office.

How to make a Data Access Request?

Under the Ordinance, every individual has the right to request a data user, e.g. government department or a company, to confirm whether it holds his or her personal data and to request a copy of any such data. Such a request is called a data access request.

Complaint Handling

After receiving a complaint and verifying the identity of the complainant, the Privacy Commissioner will first liaise with the complainant and, if necessary, the party complained against to determine whether a prima facie case can be established. If there is a prima facie case, the Privacy Commissioner will try to resolve the dispute through mediation. If the dispute cannot be resolved in this way, the Privacy Commissioner may carry out a formal investigation. The Privacy Commissioner may also immediately proceed to undertake a formal investigation if the suspected contravention in the complaint case is of a serious nature. If an investigation confirms that the data user has contravened a requirement under the Ordinance, the Privacy Commissioner may (if it is likely that the contravention will continue or be repeated) serve an enforcement notice on the data user concerned to direct it to take the necessary steps to remedy the contravention and/or instigate prosecution action. Contravention of an enforcement notice is an offence which could result in a fine and imprisonment.