The Personal Data (Privacy) Ordinance (the Ordinance) has a definition of "matching procedure". The definition can be divided into four criteria for determining whether a particular process of comparing personal data is a "matching procedure". All four criteria must be met before such a process qualifies as a "matching procedure". The four criteria are that :

1. there is a comparison of two sets of personal data, each of which is collected for different purposes, e.g. one set of personal data collected for purposes A and B and a second set collected for purposes X and Y;
2. each comparison involves the personal data of 10 or more data subjects;
3. the comparison is not carried out by manual means, e.g. it is carried out by using a computer programme designed and applied for performing the comparison process; and
4. the end result of the comparison may be used, whether immediately or at any subsequent time, for the purpose of taking adverse action against any of the data subjects concerned.

Section 30 of the Ordinance provides that a matching procedure may not be carried out unless one of the following conditions has been met:-

1. all the individuals who are the subjects of the data to be matched have voluntarily given express consent to the matching procedure being carried out;
2. the Privacy Commissioner has given consent under section 32 of the Ordinance for the matching procedure to be carried out;
3. the matching procedure belongs to a class of matching procedures which the Privacy Commissioner has specified by notice in the Government Gazette as a class of such procedures that may be carried out; or
4. the matching procedure is required or permitted by a provision of an Ordinance specified in Schedule 4 to the Ordinance.

The Privacy Commissioner has not specified any class of matching procedures as a class of such procedures that may be carried out, condition (c) above; neither have any provisions of an Ordinance requiring or permitting a matching procedure been specified in Schedule 4 to the Ordinance, condition (d) above. Accordingly, if someone wishes to carry out a matching procedure in compliance with section 30, they must meet either condition (a) or (b). That is, they must either obtain the express consent of the individuals who are the subjects of the data to be matched or seek the consent of the Privacy Commissioner to carry out the matching procedure concerned.

Consent of the Privacy Commissioner should be sought using a matching procedure consent application form, which can be obtained from the Office of the Privacy Commissioner for Personal Data at 12/F, 248 Queen's Road East, Wanchai, Hong Kong.