Judicial Review

Wu Kit Ping v Administrative Appeals Board, HCAL 60 of 2007

An application for judicial review was made by a complainant against the decision made by the Administrative Appeals Board ("AAB").

The crux of the complaint was that the complainant, a patient of a hospital clinic, was dissatisfied that certain parts of the statements and documents requested in her data access request ("DAR") made against the hospital were redacted by the hospital in compliance with her DAR. The data in dispute consisted essentially of the names, job title and contact details of the makers and recipients of the statements and certain paragraphs of a statement made by a medical doctor.

At the hearing, the presiding judge examined provisions of the Ordinance in relation to the right of a data subject to make a DAR under section 18, the scope of its exercise and the protection of third parties' personal data under section 20(1)(b) and 20(2). It was ruled that under section 18(1)(b), a data subject is only entitled to a copy of his personal data, not every document upon which there is a reference to the individual. It was also not the purpose of the Ordinance that the data access right be exercised by a data subject to supplement the right of discovery in legal proceedings nor to add any wider action for discovery for the purpose of discovering the identity of a wrongdoer or to locate information for other purposes, such as litigation. The Judge ruled that the identities of the maker and the recipients of the reports did not fall within the scope of "personal data" to relate directly or indirectly to the complainant, and hence the redaction was lawfully made.

Section 20(1)(b) provides that where in the course of complying with a DAR, the personal data of some other individual must be disclosed, then unless that other individual has consented to the disclosure of his personal data, the request must be refused. According to the Judge, the section was to be read subject to section 20(2) in that if the data user could supply to the data subject his personal data without disclosing the identity of the source of the information, then a means to supply the data must be found, and the obvious way to achieve this was by redaction of the identity of the source of the information. The fact that deduction or inference of the source of information might be drawn by the data subject was no barrier to compliance with the DAR.

In relation to expression of opinion by the maker of the document about himself, the Judge ruled that unless it related indirectly to the data subject, it would not constitute the personal data of the data subject. Having examined the unedited versions of the requested data, the Judge ruled that save for one sentence contained in the statement which should be disclosed to the complainant, the rest of the redaction was properly made by the hospital.