The Complaint

The complainant was previously convicted in 1991 and was arrested by a law enforcement agency ("the Agency") for another offence in 2006. After the arrest, the Agency took photographs of the complainant and obtained copy of his identity card, his telephone number and address. The Agency subsequently decided not to prosecute the complainant but refused to return the personal data to him.

The complainant complained to the Commissioner that: (i) the Agency had used his personal data obtained in 2006 to search for his previous conviction records and such use was prohibited by DPP3; and (ii) the Agency should not have kept the personal data after they decided not to prosecute him, and such retention was prohibited by DPP2(2).

Findings by the Commissioner

The Commissioner found that, as the Ordinance does not prohibit a data user from searching personal data kept in his records and there was no evidence to suggest that the Agency had disclosed or transferred the complainant's personal data for other purposes, the Agency's act of searching the complainant's previous criminal conviction records did not constitute a contravention of the Ordinance.

On the retention of the complainant's personal data, the Agency explained to the Commissioner that since the complainant was previously convicted, they would retain the complainant's photographs as prescribed by statute and that they would retain the other personal data (identity card copy, telephone number and address) for 12 months for possible use in future investigation of offence or internal investigation. The Commissioner was satisfied that the Agency was entitled to retain the complainant's photographs under the statutory provision and that the retention period of 12 months in relation to the other personal data was reasonable in the circumstances. Therefore, the Agency had not contravened DPP2(2).

Having considered all the circumstances, the Commi s s ioner decided not to car ry out an investigation. The complainant appealed against the Commissioner's decision.

The Appeal

The AAB agreed with the Commissioner's findings on the Agency's use of the complainant's personal data and further added that, in any event, the personal data obtained in 2006 should be held for the purposes of the protection or detection of crime or the apprehension, prosecution or detention of offenders and, therefore, would be exempted from DPP3 by virtue of section 58(2) of the Ordinance.

The AAB was also satisfied that the Agency's retention of the complainant's photographs was permitted by the statutory provision. Moreover, having further considered that the Agency's internal guidelines in which the retention period of 12 months was expressly provided, the AAB found that the retention period of 12 months was reasonable and consistent with DPP2(2).

AAB's Decision

The appeal was dismissed.

The Complaint

The complainant was a university student. She made a data access request ("DAR") to the university for copies of her examination script ("the Script") and the related external examiner's correspondence ("the Correspondence") one year after the examination. The university replied they were unable to comply with her DAR because (1) it was the normal policy of the university department in question to destroy examination scripts after 1 year; (2) the Script did not contain any personal data of hers; and (3) the Correspondence merely contained comments on the examination arrangements and did not give specific comment on individual script. Dissatisfied with the reply, the complainant lodged a complaint with the Commissioner for the failure of the university to comply with her DAR.

Findings by the Commissioner

Generally speaking, a student's answers in an examination do not amount to personal data of the student unless the answer contains information about the student personally. There is no provision in the Ordinance that requires a data user to retain personal data. Having examined the university's code of practice and the Correspondence, the Commissioner accepted that the university's code of practice did not impose any specific time limit for the retention of the mark sheets and examination scripts and there was no contrary evidence to show that the university did hold the Script at the time of receipt of the DAR. The Commissioner had also examined the Correspondence and agreed that it did not contain personal data of the complainant. Since there was no prima facie evidence of contravention of section 19(1), the Commissioner decided not to carry out an investigation of the complaint under section 39(2)(d). The complainant appealed against the Commissioner's decision.

The Appeal

The complainant contested that the Commissioner was wrong in accepting the explanation of the university that the department's practice was to destroy examination scripts after 1 year and they no longer held the Script. She argued that the university had a duty to retain the Script in order to comply with DPP4 in protecting the personal data against "unauthorized or accidental access, processing, erasure or other use…". She also argued that the Script and the Correspondence contained her personal data. The complainant, however, could not supply any evidence to support her claims. The AAB was satisfied that the Commissioner did not act unreasonably in accepting the university's explanation that they did not hold the Script and that the Correspondence did not contain her personal data.

The AAB remarked that if an examination script of the complainant was marked with the examiner's comments or evaluation of the complainant's answers, these evaluation or comments could be personal data of the complainant. In the present case, examination scripts contained only the materials written by students because examiners were not allowed to write any remarks on the scripts. The Commissioner did not err in holding that the complainant's answers in the Script did not amount to her personal data.

In relation to the duty to retain personal data, the AAB rejected the complainant's arguments and ruled that neither the provisions of the Ordinance imposed any positive duty on a data user to keep or retain one's personal data until the purpose for which the data was originally collected is exhausted; nor did they require a data user to justify its deliberate decision of not continuing to retain one's personal data.

AAB's Decision

The appeal was dismissed.