An employee wrote a complaint letter to the management of his employer complaining against his supervisor about staff duty roster arrangements. The management gave a copy of the complaint letter to the supervisor so that he could respond to the complaint in person. Later, the management sent a copy of a memo to the supervisor that set out the management's findings in respect of the complaint. The letter and the memo contained information relating to the employee. The supervisor posted copies of the complaint letter and the memo on a notice board inside the staff rest room for the information of colleagues about the complaint and related findings.
Although copies of the letter and the memo were supplied to the supervisor without his solicitation in the first place, by subsequently posting the letter and the memo on the notice board, the supervisor had made himself a data user in respect of the employee's data. The supervisor, in receiving the data, ought to have known that the data were to be used for investigating the complaint made by the employee. Even if the employee were to be invited to give his consent, it was unlikely that he would have given consent to the public display of those data. The posting of copies of the letter and the memo on the notice board causing display of the employee's personal data to parties unrelated to the complaint was an act contrary to the requirements of DPP3.