Case Notes

(AAB Appeal No. 42 of 2024)

Refusal of data correction request by data user – whether justified – whether data sought to be corrected is expression of opinion – the role of the Privacy Commissioner in handling complaints concerning data correction requests in the context of employment dispute – section 24(3), 25(1) and 25(2) of the PDPO

Coram:
Ms Jay MA Suk-lin (Deputy Chairman)
Mr SY Ming-yiu (Member)
Mr Victor WONG Wai-keung (Member)

Date of Decision: 6 June 2025

The Complaint

The Appellant was a former teaching staff of a university (University). She made a data correction request (DCR) to the University to remove four statements (Statements) from her job appraisal and related documents.

Upon receiving the DCR, the University took steps to locate and check the relevant records, and regarded the Statements as general expressions of opinion by the appraiser which were unverifiable, and therefore refused to comply with the DCR.

Dissatisfied with the University’s response, the Appellant complained to the PCPD. In particular, the Appellant contended that the Statements were verifiable facts, as opposed to expression of opinion. The Appellant also contended that the University had failed to comply with section 25(2)(b) of the PDPO whereby a data user is required to make a note and attach a copy of the same to the notice refusing a DCR, if the data user is not satisfied that the opinion is inaccurate.

The Privacy Commissioner’s Decision

Upon receipt of the complaint, the Privacy Commissioner made enquiries with the University, which confirmed that it had received the DCR and attempted to check the possible sources of the relevant records but no additional records could be found. Henceforth, the University regarded the Statements as general expressions of opinion by the appraiser which were unverifiable, nor was there sufficient basis to doubt their accuracy.

Having carefully considered all the relevant information available and the circumstances of the case, the Privacy Commissioner found that: -

1. Although not all of the Statements were expressions of opinion, the University was justified in relying on section 24(3)(b) and (c) of the PDPO to refuse compliance with the DCR.
2. The University had contravened section 25(1) of the PDPO, as it was not until the Privacy Commissioner’s intervention that the University explained to the Appellant that it relied on sections 24(3)(b) and (c) of the PDPO to refuse compliance with the DCR via email, which was issued after 40 days from the University’s receipt of the DCR.
3. The University had contravened section 25(2) of the PDPO, as it was not until the Privacy Commissioner’s intervention that the University had annexed a note to the Statements or elsewhere of the matters in respect of the alleged inaccuracies in the specified way, and attached a copy of the note to the written notice issued to the Appellant informing her of the refusal to comply with the DCR.

Taking into account the follow-up actions taken by the University, the Privacy Commissioner considered the Appellant’s concerns addressed and resolved, and that investigation of the case cannot reasonably be expected to bring about a more satisfactory result. As such, the Privacy Commissioner decided not to carry out an investigation into the case pursuant to section 39(2)(d) of the PDPO and in accordance with paragraph 8(h) of the Complaint Handling Policy.

In addition, the Privacy Commissioner put the University on warning that it shall strictly comply with the relevant requirements of the PDPO when handling data correction requests.

Dissatisfied with the Privacy Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB confirmed the Privacy Commissioner’s decision and dismissed the appeal on the following grounds:-

1. The relevant data pursuant to the Appellant’s DCR is not in the nature of common personal data such as name, age and address. The data requested by the Appellant to be corrected could legitimately be seen as comments held by the appraiser concerning the Appellant’s job performance. There is no reasonable justification for the Privacy Commissioner to doubt the meaning and veracity of the reply provided by the University as to the subjective feedback of the appraiser.
2. With reference to the view expressed in AAB No.14/2018, it was not for the Privacy Commissioner to carry out a full investigation into the Appellant’s job performance. It is also not the legislative intent of the PDPO for the Privacy Commissioner to adjudicate employment disputes.
3. As such, in view of the follow-up remedial action taken by the University, the AAB was satisfied that any investigation cannot reasonably be expected to bring about a more satisfactory result. The Privacy Commissioner was not wrong in exercising her discretion not to commence investigation.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in December 2025)