A disastrous traffic accident occurred overseas a few days ago resulting in the death of and injury to Hong Kong residents. After the accident, the travel agent concerned was reported to have refused to disclose the names of the victims in order to protect their personal data privacy. Different opinions are held on this matter within the community and it gives rise to the community’s concern that the disclosure of victims’ personal data after an unfortunate incident would infringe their privacy rights.

Under the Personal Data (Privacy) Ordinance (the “Ordinance”), personal data means recorded information relating to a living individual (excluding deceased persons) from which it is reasonably practicable to identify the individual concerned, and that are reasonably practicable to access or process.

According to the relevant provisions of the Ordinance relating to the use of personal data, Data Protection Principle 3 (“DPP 3”) of the Ordinance stipulates that personal data shall not be used for a purpose other than its original purpose of collection or its directly related purposes unless it is with the prescribed consent of the data subject.

Different immediate needs may arise within the community after an unfortunate incident: ensuring survivors’ safety, timely release of updated information or to prevent the spread of disease. As a result, data users are required to disclose different extents of personal data of relevant individuals. For instance, it was necessary to disclose the dwelling and work place information of SARS patients during the SARS period. After the south Asian tsunami, it was necessary to disclose the names of the missing persons so as to locate people who were actually missing.

As stated above, DPP3 stipulates that personal data shall not be used for a purpose other than its original purpose of collection or its directly related purposes unless it is with the prescribed consent of the data subject. Somehow the Ordinance does provide exemptions where the use of personal data is not restricted by the provisions of the Ordinance. Section 59 of the Ordinance provides that in a case where the application of the provisions to personal data would be likely to cause serious harm to the physical or mental health of the data subject or any other individual, the provisions would be exempted. Section 61 also provides that personal data is exempt in the event that such disclosure is made by a data user who has reasonable grounds to believe that the disclosure of the personal data is in the public interest.

However, the terms serious harm or public interest are not explicitly defined in the Ordinance and it is not compulsory for data users to apply the exemptions. In any case, data users should decide at their own discretion whether the exemption is applicable when disclosing victims’ personal data and should be aware that it could cause unnecessary distress to them and intrude upon their privacy.

The Privacy Commissioner for Personal Data, Mr. Roderick Woo, opined that data users should seriously consider victims’ data privacy rights and feelings when deciding whether or not to disclose their personal data after an unfortunate incident, and strike a balance between personal data privacy and public interest in the course of their decision.