The 834 complaint cases received in 2007-2008
involved a total of 1344 alleged breaches of the
requirements of the Ordinance. Of these, 1169 (87%)
were alleged breaches of the data protection principles
and 175 (13%) were alleged contraventions of the
provisions in the main body of the Ordinance.
Of the 1169 alleged breaches of the data protection
principles, 242 (21%) concerned the alleged excessive
or unfair collection of personal data of complainants.
In this categor y, 45 cases (19%) involved
allegations, some are against financial institutions
or telecommunications companies, for collection of
complainants' personal data from unknown sources for
the recovery of debts or direct marketing purposes.
There is a misunderstanding among some complainants
regarding the ambit of the Ordinance when applies
to collection of personal data. A common example is
that some complainants believe that their personal
data can only be collected from them direct or after
prior consent having been obtained from them or that
they must be notified of it. The Ordinance provides
that personal data shall be collected by means which
are lawful and fair in the circumstances of the case.
However, the Ordinance does not require a data user
to obtain the consent of the data subject for collection
from third party of his personal data or to notify him
of the collection. In an administrative appeal case,
the Administrative Appeals Board ruled that the
mere evidence of the holding of personal data by
a person could not prove that he had obtained the
data by unfair or unlawful means. Accordingly, the
collection of personal data from sources other than
the data subject without his knowledge or consent,
without more, does not suggest a contravention of
the Ordinance. |