The objective of the Personal Data (Privacy) Ordinance (Cap. 486) (pdf format) is to protect the privacy rights of a person in relation to personal data (Data Subject).
(1) The information which relates to a living person and can be used to identify that person. (2) It exists in a form in which access or processing is practicable.
Examples of personal data protected by the Ordinance include names, phone numbers, addresses, identity card numbers, photos, medical records and employment records.
A person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data. The Data User is liable as the principal for the wrongful act of its authorised data processor.
Everyone who is responsible for handling data (Data User) should follow the Six Data Protection Principles ("DPPs") which represents the core of the Ordinance covering the life cycle of a piece of personal data:
Personal data must be collected in a lawful and fair way, for a purpose directly related to a function /activity of the data user.
Data subjects must be notified of the purpose and the classes of persons to whom the data may be transferred.
Data collected should be necessary but not excessive.
Practicable steps shall be taken to ensure personal data is accurate and not kept longer than is necessary to fulfil the purpose for which it is used.
Personal data must be used for the purpose for which the data is collected or for a directly related purpose, unless voluntary and explicit consent with a new purpose is obtained from the data subject.
A data user needs to take practicable steps to safeguard personal data from unauthorised or accidental access, processing , erasure, loss or use.
A data user must take practicable steps to make personal data policies and practices known to the public regarding the types of personal data it holds and how the data is used.
A data subject must be given access to his/her personal data and allowed to make corrections if it is inaccurate.
The Ordinance provides: