| Legal Work |
Notes on Appeal Cases Lodged with the Administrative Appeals Board
A total of 20 AAB appeal cases were heard during the reporting
period. Case notes on selected cases are presented below.
|
A law enforcement agency's use and retention of personal data
obtained during an arrest |
| |
Use of personal data of an arrested person to search for his past conviction records –
retention of photographs, identity card copy, telephone number and address of an
arrested person – arrested person not prosecuted – retain the data for 12 months –
DPP2(2), DPP3, section 58 (AAB Appeal No. 1/2007) |
|
|
|
The Complaint
The complainant was previously convicted in 1991
and was arrested by a law enforcement agency
("the Agency") for another offence in 2006. After
the arrest, the Agency took photographs of the
complainant and obtained copy of his identity
card, his telephone number and address. The
Agency subsequently decided not to prosecute the
complainant but refused to return the personal data
to him.
The complainant complained to the Commissioner
that: (i) the Agency had used his personal data
obtained in 2006 to search for his previous conviction
records and such use was prohibited by DPP3; and (ii)
the Agency should not have kept the personal data
after they decided not to prosecute him, and such
retention was prohibited by DPP2(2). |
|
Findings by the Commissioner
The Commissioner found that, as the Ordinance does
not prohibit a data user from searching personal data
kept in his records and there was no evidence to
suggest that the Agency had disclosed or transferred
the complainant's personal data for other purposes,
the Agency's act of searching the complainant's
previous criminal conviction records did not constitute
a contravention of the Ordinance.
On the retention of the complainant's personal data,
the Agency explained to the Commissioner that since
the complainant was previously convicted, they would
retain the complainant's photographs as prescribed
by statute and that they would retain the other
personal data (identity card copy, telephone number
and address) for 12 months for possible use in future
investigation of offence or internal investigation. The
Commissioner was satisfied that the Agency was
entitled to retain the complainant's photographs
under the statutory provision and that the retention
period of 12 months in relation to the other personal
data was reasonable in the circumstances. Therefore,
the Agency had not contravened DPP2(2).
Having considered all the circumstances, the
Commi s s ioner decided not to car ry out an
investigation. The complainant appealed against the
Commissioner's decision. |
|
The Appeal
The AAB agreed with the Commissioner's findings
on the Agency's use of the complainant's personal
data and further added that, in any event, the
personal data obtained in 2006 should be held for
the purposes of the protection or detection of crime
or the apprehension, prosecution or detention of
offenders and, therefore, would be exempted from
DPP3 by virtue of section 58(2) of the Ordinance.
The AAB was also satisfied that the Agency's retention
of the complainant's photographs was permitted by
the statutory provision. Moreover, having further
considered that the Agency's internal guidelines
in which the retention period of 12 months was
expressly provided, the AAB found that the retention
period of 12 months was reasonable and consistent
with DPP2(2). |
|
AAB's Decision
The appeal was dismissed. |
|
|
DAR to a school for examination script refused because it did not
contain the student's personal data |
| |
Data access request made by a university student for examination script and external examiner's correspondence – university no longer held the examination scripts after 1 year – no evidence to the contrary found – external examiner’s correspondence did not contain the Appellant’s personal data – no contravention of sections 19(1) and 26, DPP2(2) and DPP4 (AAB Appeal No. 7/2007) |
|
|
|
The Complaint
The complainant was a university student. She made
a data access request ("DAR") to the university for
copies of her examination script ("the Script") and
the related external examiner's correspondence ("the
Correspondence") one year after the examination.
The university replied they were unable to comply
with her DAR because (1) it was the normal policy
of the university department in question to destroy
examination scripts after 1 year; (2) the Script did
not contain any personal data of hers; and (3) the
Correspondence merely contained comments on the
examination arrangements and did not give specific
comment on individual script. Dissatisfied with the
reply, the complainant lodged a complaint with the
Commissioner for the failure of the university to
comply with her DAR. |
|
Findings by the Commissioner
Generally speaking, a student's answers in an
examination do not amount to personal data of
the student unless the answer contains information
about the student personally. There is no provision
in the Ordinance that requires a data user to retain
personal data. Having examined the university's
code of practice and the Correspondence, the
Commissioner accepted that the university's code
of practice did not impose any specific time limit for
the retention of the mark sheets and examination
scripts and there was no contrary evidence to show
that the university did hold the Script at the time
of receipt of the DAR. The Commissioner had also
examined the Correspondence and agreed that it did
not contain personal data of the complainant. Since
there was no prima facie evidence of contravention
of section 19(1), the Commissioner decided not to
carry out an investigation of the complaint under
section 39(2)(d). The complainant appealed against
the Commissioner's decision. |
|
The Appeal
The complainant contested that the Commissioner
was wrong in accepting the explanation of the
university that the department's practice was to
destroy examination scripts after 1 year and they no
longer held the Script. She argued that the university
had a duty to retain the Script in order to comply
with DPP4 in protecting the personal data against
"unauthorized or accidental access, processing,
erasure or other use…". She also argued that
the Script and the Correspondence contained her
personal data. The complainant, however, could
not supply any evidence to support her claims.
The AAB was satisfied that the Commissioner did
not act unreasonably in accepting the university's
explanation that they did not hold the Script and
that the Correspondence did not contain her
personal data.
The AAB remarked that if an examination script of
the complainant was marked with the examiner's
comments or evaluation of the complainant's
answers, these evaluation or comments could be
personal data of the complainant. In the present
case, examination scripts contained only the materials
written by students because examiners were not
allowed to write any remarks on the scripts. The
Commissioner did not err in holding that the
complainant's answers in the Script did not amount
to her personal data.
In relation to the duty to retain personal data, the
AAB rejected the complainant's arguments and
ruled that neither the provisions of the Ordinance
imposed any positive duty on a data user to keep
or retain one's personal data until the purpose
for which the data was originally collected is
exhausted; nor did they require a data user to justify
its deliberate decision of not continuing to retain
one's personal data. |
|
AAB's Decision
The appeal was dismissed. |
|
| [image] |
| |
[Previous Page][Table of Contents][Next Page] |