Figure 1 - Annual Complaint Caseload

A total of 972 complaint cases were received in 2005-2006
(an increase of 2% on the previous year).

Figure 2 - Types of Party Complained Against

• 699 (72%) complaint cases were against private sector organizations.
  
• 121 (12%) complaint cases were against individuals.
  
• 152 (16%) complaint cases were against public sector organizations
  (i.e. government departments and other public bodies).

Figure 3 - Complaints Against Private Sector Organizations

The majority of complaints against the financial and telecommunications sectors alleged the unlawful use of customers' personal data. Most of the complaints involved recovery actions for overdue loan/service payments

Figure 4 - Complaints Against Public Sector Organizations

The majority of complaints against public sector organizations involved:

• the alleged use of personal data beyond the scope of collection purpose and without the consent of the individual (36%);
  
• excessive or unfair collection of personal data (22%);
  
• non-compliance with data access or correction requests (20%);
• and lack of security measures to protect personal data (19%).

Figure 5 - Nature of Complaints

The 972 complaint cases received in 2005-2006 involved a total of 1079 alleged breaches of the requirements of the Ordinance. Of these, 916 (85%) were alleged breaches of the data protection principles and 163 (15%) were alleged contraventions of the provisions in the body of the Ordinance.

Of the 916 alleged breaches of the data protection principles, 471 (51%) concerned the alleged use of personal data of complainants without their consent. In this category, 84 (18%) involved debt collection, mostly allegations against financial institutions and telecommunications companies for passing customers' personal data, such as contact details and amount of indebtedness, to debt collecting agencies for the recovery of outstanding debts.

There is a misunderstanding among some complainants regarding the ambit of the Ordinance when applied to use or disclosure of personal data. A common example is that some complainants believe their personal data can only be used or disclosed to others after prior consent concerning a particular act has been obtained from them. The Ordinance restricts the purpose of use or disclosure of personal data to their original collection purpose or a directly related purpose. Any other use or disclosure of personal data requires the express consent of the data subject concerned. In other words, if the use or disclosure of personal data is within an original collection purpose, or a directly related purpose, it is not necessary for the data user to obtain the consent of the data subject prior to use or disclosure.