The Privacy Commissioner for Personal Data has specified a Form to assist individuals to make data access requests under the Personal Data (Privacy) Ordinance.
Under the Ordinance, an individual has the right to ascertain from a data user, as for example a commercial organisation or a government department, whether it holds his or her personal data and, if so, request the data user to provide him or her with a copy of such data. A data user is required to respond within 40 days of the request.
The Privacy Commissioner has specified the "Data Access Request Form" in view of the misunderstanding often found among both individuals and organisations in relation to data access requests under the Ordinance. The Form is aimed at facilitating the process of data access requests by assisting individuals to state their requests clearly and reminding organisations of their obligations under the Ordinance.
"Our experience in handling enquiries and complaints reveals that misunderstanding is common among both data users and individuals in this area," a spokesperson for the Office of the Privacy Commissioner for Personal Data (PCPD) said.
"Of the 958 complaints received by the PCPD since the Ordinance was brought into force on 20 December, 1996, 101 complaints (11%) are related to data access and correction requests. These include complaints against organisations mainly for failing to respond to data access requests within the required 40 days, failing to give reasons for refusing a data access request, and not providing data to the extent requested by and entitled to the individuals," the spokesperson added.
The PCPD has completed investigation into 88 of these cases and issued a total of 14 warning notices and two enforcement notices to the parties complained against, directing them to take appropriate remedial actions.
"There were also instances in which an individual did not make clear that his or her request for data was made under the Ordinance or did not provide sufficient information to facilitate the locating of the data, thus leading to delays in responses to their requests," the spokesperson added.
"The specified Form helps an individual state specifically what his or her request covers, for example, whether this includes any data already in his or her possession. It also reminds data users of their obligation to respond within 40 days. It should assist in reducing the misunderstanding aforementioned and expediting the process of handling data access requests," the spokesperson said.
The PCPD has also issued an explanatory pamphlet "Exercising Your Data Access Rights" which spells out the rights of the individuals relating to data access requests under the Ordinance and provides guidance to individuals on how to fill out the specified Form.
The specification of the Form was gazetted today (Friday) and the Form will take effect on 1 December, 1999. A period of two and a half months has been allowed for organisations to prepare for incorporating the specified Form into their data access request handling policies and practices.
"Although the use of the specified Form is not mandatory, any data access requests not made with the specified Form after it has come into effect may be refused by data users. We strongly recommend that individuals and organisations use this Form for making and handling data access requests respectively," the spokesperson said.
The specified Form and the explanatory pamphlet can be obtained from all district offices and the PCPD office at Unit 2001, 20/F., Office Tower, Convention Plaza, 1 Harbour Road, Wanchai. These documents can also be found and downloaded from the PCPD web site at http://www.pcpd.org.hk