Non-compliance by a former employer with a series of data access requests made under section 18(1) - the complainant alleged wrongful omission, deletion and non-supply of his data - complaints were found to be frivolous or vexatious or not made in good faith under section 39(2)(c) - the complainant applied for a judicial review of the Privacy Commissioner's decision not to investigate - through other proceedings the complainant obtained , or could have obtained, the personal data he requested - relief sought became meaningless - application dismissed by Court.

(HCAL 94/2003)

The Complaint

The complainant was a former employee of a Government Department.("the Department"). Shortly before and after termination of his employment, he made a series of six data access requests against the Department under section 18(1) of the Ordinance requesting access to his personal data complained in minutes, documents and statements made about him. The complainant indicated that the requested data would be useful in considering whether to commence proceedings against the Department and other relevant parties. The Department provided him with some, but not all, of the data requested in his data access requests. The data not provided to the complainant were either not possessed by the Department or related to third parties. The complainant lodged a series of complaints with the Privacy Commissioner alleging non-compliance with his data access requests by the Department.

Findings of the Privacy Commissioner

The Privacy Commissioner found no prima facie case of contravention by the Department in responding to the complainant's data access requests. It was also noted that over a period of 2 years and 9 months, the complainant had lodged a total of 19 complaints with the Privacy Commissioner that were similar in nature to the present complaint and that in each instance investigation was either found to be unnecessary, or no finding of contravention resulted from the investigation. Some of the past complaints were found to be frivolous or vexatious, or not made in good faith. The Privacy Commissioner found that he true nature of the complainant's grievance related primarily to his previous employment with the Department rather than any infringement of his personal data privacy. That being the case, the view taken was that some other redress mechanism would be more appropriate in pursuing the employment grievance. In addition, the complaint mechanism afforded under the Ordinance was not intended for use as an instrument of harassment of another party who just happened to be a data user. Having considered all the circumstances, the Privacy Commissioner decided not to investigate by reason of section 39 (2)(c), i.e. that the complaints were frivolous or vexatious or not made in good faith.

The Application for Judicial Review

The complainant applied for judicial review seeking to quash the Privacy Commissioner's decision not to investigate. He alleged, inter alia, procedural impropriety and error of law on the part of the Privacy Commissioner in arriving at the decision not to investigate. He claimed that the decision was ultra vires as the notification given to him by the Privacy Commissioner under section 39(3) was made more than 45 days after receipt of his complaints.

It transpired during the hearing that the complainant had obtained, through other proceedings brought by him against the Department and its staff, either the personal data he alleged has been omitted by the Department or confirmation as to the non-existence of a witness statement alleged to be in the possession of the Department. The Judge found that since the complainant had obtained, or could have obtained, copies of personal data he requested, relief to be granted, even if he succeeded in his application, would be meaningless and a waste of public funds. The Judge found it unnecessary to go into the merits of the applications or give any ruling on the arguments submitted as this would be academic.

The Court's Decision

The application was dismissed.