Report on Activities - Legal

Notes on Appeal Cases Lodged with the Administrative Appeals Board (AAB)

Under the PD(P)O, where the Privacy Commissioner has decided to exercise his power under section 39 to refuse to investigate or to continue to investigate a complaint brought to him, the complainant may appeal to the Administrative Appeals Board against such decision. Furthermore, where the Commissioner had completed an investigation, his decision not to issue an enforcement notice against the data user complained against may be the subject of an appeal to the Board by the complainant. Alternatively, if as a result of an investigation the Commissioner decides to issue an enforcement notice against the data user investigated against, the data user may also appeal to the Board against the enforcement notice so issued.

Appeal arising from complaint about collection of faxed statement (1/02)

The complainant lodged a complaint against a colleague in the government institution where he worked. An incident involving fighting had occurred while he was on duty at the institution and, as a consequence, he had made a statement to another government department investigating the incident. Subsequently, the investigating department faxed a copy of the statement to the complainant via a fax number of the institution. The complainant alleged that the colleague had kept a copy of the statement, which contained his personal data.

During the course of an investigation by the Commissioner, the complainant and the individuals concerned with the complaint gave different accounts on the events pertaining to the complaint. The Commissioner thus summoned the relevant individuals before him for an examination under oath under Section 44 of the PD(P)O. After carrying out an investigation, the Commissioner formed the view that there was insufficient evidence to prove that the colleague concerned had kept a copy of the statement as alleged by the complainant. Therefore, the Commissioner found that there was no contravention of DPP1(2) or DPP2(2) and decided not to issue an enforcement notice accordingly. The complainant appealed and sought to call two new witnesses during the appeal proceedings.

After hearing the appeal, the AAB decided that the Commissioner had already undertaken a very full examination of the relevant witnesses. The transcript of the examination ran to more than 80 pages. Given the very full extent of the examination, the AAB decided not to exercise its discretion to allow the two new witnesses to be called at the appeal when the complainant offered no adequate reason to explain why he had not suggested those two witnesses to be summoned for questioning at the previous examination. The AAB further decided that the Commissioner, having seen and heard the relevant witnesses under oath, was entitled to make those findings of facts being challenged in the appeal. The AAB considered it neither necessary nor desirable in the present case, where the issue was essentially one of credibility in a dispute of fact, to re-hear the relevant witnesses for the purpose of making separate findings of fact. Hence, the AAB unanimously upheld the decision of the Commissioner not to issue an enforcement notice.

Appeal arising from complaint about refusal to comply with data correction request in relation to consumer credit data (2/02)

The complainant lodged a complaint to the PCPD against a credit reference agency. He alleged that the agency had refused to comply with his request for correction by deleting certain inaccurate consumer credit data held by the agency in respect of him. However, after making enquiries with the relevant credit provider who supplied the agency with the credit data in question, the agency received oral confirmation from it that the credit data were accurate. Thus, the agency refused to comply with the request for correction.

After considering the complainant's allegations and making some preliminary enquiries, the PCPD notified the complainant under section 39 of the PD(P)O that there was to be no further investigation of the case. The reason was that what had been done by the agency was clearly in accordance with the requirements of the then paragraph 2.9 of the Code of Practice on Consumer Credit Data. (Paragraph 2.9 of the Code provided that upon receiving a request for correction, the credit reference agency should promptly consult with the credit provider. It further provides that if the agency did not receive from the credit provider any confirmation or correction of the disputed data within 40 days from the correction request, the relevant data should, upon expiry of the 40 days, be deleted or otherwise amended as requested.) Dissatisfied with the PCPD's decision, the complainant appealed.

In the appeal, the complainant contended that the agency had not taken, as required by DPP2(1)(a), all reasonably practicable steps to ensure that the data were accurate having regard to the purpose for which the personal data were or were to be used. After hearing the appeal, the AAB held that the central issue was whether the agency could adequately discharge its responsibility under DPP2(1)(a) by relying upon the oral confirmation provided by the relevant credit provider that the credit data concerned were accurate. The AAB considered that, not being a party to the credit transaction in question, the agency could only rely upon information provided to it by the credit provider. On that basis, the AAB upheld the Commissioner's decision and dismissed the appeal. Incidentally, the AAB recommended that any confirmation provided by a credit provider that the credit data in dispute was accurate should be made in writing in order to prevent misunderstanding.