Whether the use of database maintained by the Registration of Persons Office is in contravention of the Personal Data (Privacy) Ordinance.

A: Our view is that pursuant to Reg. 8(1) of the Registration of Persons Regulations (Cap. 177, sub. Leg.) the said database is kept by the Commissioner of Registration for the purposes of the said Ordinance and Regulations. While such purposes consist mainly in purposes related to the normal functions of the Immigration Department, they also include the purpose of disclosure pursuant to Reg. 24. In particular, Reg. 24 allows the disclosure of information with the written permission of the Chief Secretary for Administration. Hence, if a registration officer discloses to you information held in the database pursuant to written permission from the Chief Secretary for Administration, it would appear to us that such disclosure constitutes one of the purposes for which the data are held. Accordingly, this would be consistent with the requirements of the Personal Data (Privacy) Ordinance.

Conversely, should the Registration of Persons Office disclose to you information held in its database without the written permission required by Reg. 24 or otherwise give you the use of its database to furnish the information sought by you, such disclosure or other use would be different from the purpose for which the data are being held by that Office under Cap. 177. Such disclosure or other use would amount to contravention of data protection principle 3 in Schedule 1 to the Personal Data (Privacy) Ordinance, which provides that personal data shall not be used for any purpose other than the purpose for which such data were to be used at the time of their collection, unless the express and voluntary consent of the data subject to such use has been obtained (which we assume to be impracticable in the present case).