Personal Data (Privacy) Ordinance
A Guide For Data Users No. 3
Outline Action Plan For Complying with the Data Protection Principles

ACTION 1 - Collect Personal Data Fairly

Data Protection Principle 1 - purpose and manner of collection of personal data

Step 1: Identify means of collection

Identify each means by which you collect personal data. Such means may include the use of printed forms, face to face or telephone interviews, advertisements that solicit the submission of personal information or obtaining data about an individual from another person or organisation.

Step 2: Identify purposes of collection

For each means of collection of personal data identified in Step 1, identify the purposes for which the personal data are being collected.

Step 3: Identify functions and activities

Identify your organisation's functions and activities.

This should be done by reference to the organisation's current scope of operations. Possible future functions and activities should not be included.

Step 4: Review means of collecting personal data

• Review each means of collecting personal data identified in Step 1 to ensure that they are lawful. Lawful here means lawful under both criminal and civil law. An obvious example of a means of collection of personal data that is unlawful under criminal law is theft. Examples of unlawful means of collection of personal data under civil law include means involving a breach of an enforceable contract or duty of confidence.
  
  
• Review whether each means of collecting personal data identified in Step 1 is fair in the circumstances in which the means is utilised. If any of your means of collecting personal data is unfair, cease to utilise it. For example, it would generally not be fair for persons collecting personal data not to identify themselves or to give false or misleading information about their identity. Other practices that would generally be unfair would be the giving of a misleading impression about the degree of confidentiality to which the personal data will be subjected or applying undue pressure to obtain personal data.