PCPD -

Date: 26 June 2012

Privacy Commissioner Published Guidance on Handling of Data Access Request and Charging of Data Access Request

1. The Privacy Commissioner for Personal Data Mr. Allan Chiang today (26 June) published a Guidance Note, titled “Guidance on Proper Handling of Data Access Request and Charging of Data Access Request Fee by Data Users” (“the Guidance Note”) to provide general guidance to organizational data users on the proper handling of data access request (“DAR”) and the charge of DAR fees.

2.    Mr. Chiang said, “In recent years, my Office (“PCPD”) has received an increasing number of complaints related to DAR. In 2011, we handled 113 cases related to DAR, as compared with 98 cases in 2010. Amongst them, 11 cases and 9 cases related to alleged excessive charge of DAR fees in 2011 and 2010 respectively.”

3.    In 2008, a doctor was convicted of breaching sections 19 and 64 of the Ordinance and was fined $1,000 in the Kowloon City Magistrates' Courts. It was the first conviction under section 19 (non-compliance with DAR) since the enforcement of the Personal Data (Privacy) Ordinance. It conveyed a clear message to data users that the handling of DAR should not be taken lightly.

4.    “In fact, making a “data access request” is an important right vested in data subjects under the Ordinance. This right enables an individual to know whether a data user holds his personal data, and to obtain a copy of the data. It ties in with a further right under the Ordinance for data subjects to make a correction request to the data user if their personal data were found to be inaccurate. Therefore, when a data user receives a DAR, it should handle the request in compliance with the requirements under the Ordinance and should not ignore the request.”

5.    “Organizational data users who handle DARs properly will demonstrate their respect for customers’ personal data privacy and gain trust from their customers. On the contrary, failure to handle a DAR in accordance with the requirements under the Ordinance without reasonable excuse may constitute an offence and render the offender liable on conviction to a fine.” Mr. Chiang remarked.

6.    The Guidance Note covers, among other things, the following:-
-    What constitutes a DAR?
-    Steps for complying with a DAR;
-    Charge for complying with a DAR, such as how to calculate a DAR fee; and
-    Refusing to comply with a DAR, e.g. under what circumstances can a data user withhold the requested data, and steps to be taken when refusing to comply with a DAR.

Organizational data users who would like to gain an in-depth understanding of DAR provisions of the Ordinance may wish to consider enrolment in the PCPD’s professional workshops on data protection.

7.    The Guidance Note can be downloaded from the website of the PCPD (http://www.pcpd.org.hk/english/publications/files/DAR_e.pdf) or obtained from its office at 12/F., 248 Queen’s Road East, Wan Chai, Hong Kong.

END