If you suspect that your privacy rights relating to personal data are being abused, generally, you should first raise your concern with the party that you suspect of abusing your personal information. If you are dissatisfied with their response, you can lodge a complaint with the PCPD.
• Who should complain
An individual, or a "relevant person" on behalf of an individual, can make a complaint. If the individual is a minor, the "relevant person" is the individual's parent or legal guardian. Where an individual cannot manage his or her own affairs, a "relevant person" is the person who has been appointed by a court to manage those affairs. Lastly, the individual may authorize in writing someone to make the complaint on his or her behalf and that person is a "relevant person".
• How to make a complaint
A complaint can be made in writing in the Chinese or English language, giving your contact details and full particulars of your case. For convenience, this can be done by using the complaint form (OPS 001) obtainable from the PCPD. If you wish to have help, you can visit the PCPD in person and our staff will assist you in completing the complaint form. As with all your dealings with the PCPD, the information you provide will be handled in strict confidence.
• The Commissioner's follow-up action
After receiving a complaint and verifying the identity of the complainant, the Commissioner will first liaise with the complainant and the party complained against to determine whether a prima facie case can be established. If there is a prima facie case, the Commissioner will try to resolve the dispute through conciliation. If the dispute cannot be resolved in this way, the Commissioner may carry out a formal investigation. The Commissioner may also immediately proceed to undertake a formal investigation if the suspected contravention in the complaint case is of a serious nature. If the investigation confirms that the data user has contravened a requirement under the Ordinance, the Commissioner may serve an enforcement notice on the data user concerned to direct it to take necessary steps to remedy the contravention and/ or instigate prosecution action. Contravention of an enforcement notice is an offence which could result in a fine or imprisonment.
Apart from criminal sanctions that can be imposed on a data user that has contravened the Ordinance, if an individual believes that he or she has suffered damage, including injured feeling, as a result of a contravention of the Ordinance, he or she has the right to seek compensation from the data user concerned through civil proceedings.