The Paper suggested that a simple, faster and less costly mechanism be provided for the copyright owners to request Internet Access Service Providers ("IASPs") to disclose the identity of their clients allegedly engaged in online copyright infringing activities. The Privacy Commissioner considers that the mere fact that a "quick and inexpensive" alternative will make effective enforcement by a copyright owner is insufficient justification having regard to the privacy intrusion as well as the adverse action that will be taken against the data subject and that such disclosure may not fall within the original or directly related purpose of collection of personal data by the IASPs.

The Privacy Commissioner called for careful consideration by the Secretary especially in view that the Ordinance as it currently stands has provided for exemption where personal data are used for the purpose of "prevention, preclusion or remedying (including punishment) of unlawful or seriously improper conduct" and application of the use limitation principle would be likely to prejudice the purpose. Third party discovery is also available to the copyright owner to apply to court for an order of Norwich Pharmacal relief. Judicial oversight is found to be more effective in safeguarding personal data privacy right and the release of personal data by the IASPs without judicial scrutiny will likely open a floodgate for others requiring IASPs to disclose personal data prejudicing personal data privacy.