On completion of its investigations into four cases complaining about excessive fees imposed by the Hong Kong Examinations and Assessment Authority (HKEAA) for accessing marking records and examination scripts, the Office of the Privacy Commissioner for Personal Data (PCPD) published its findings today.
The investigations arose from four complaints received by the PCPD. The complaints were lodged by four candidates of 2023 Hong Kong Diploma of Secondary Education Examination (HKDSE) respectively who complained against the HKEAA for imposing excessive fees for accessing marking records and examination scripts. The relevant fees were as follows:
|
|
|
Fees imposed before destruction of scripts |
|
|
|
Years 2021 and 2022 |
Year 2023 |
Marking Records and Examination Scripts
(including personal entry particulars |
Each application
(including one subject) |
$400 |
$380 |
|
Each additional subject |
$104 |
$104 |
Background
According to the website of the HKEAA, starting from the 2023 examination, the data access requestor will not be provided with a hardcopy of the requested data, but will be provided with an email containing a password and a link for downloading the requested personal data, including marking records and examination scripts.
Complaint Matter (I)
The four complainants considered that in view of the change in the form of provision of requested data, the fee imposed for accessing the data should be reduced. However, the fee imposed by the HKEAA for the first data access application was reduced by only HK$20 (from HK$400 to HK$380). Three of the complainants also observed that the fee for accessing the data of each additional subject remained unchanged (at HK$104). The complainants thus lodged the complaints with the PCPD against the HKEAA for imposing excessive fees for accessing marking records and examination scripts. In support of their complaints, the four complainants provided the following justifications:
(1) Given that the HKEAA changed its form of providing the requested data from provision of hard copies to dissemination by way of email, one complainant questioned if three aspects of the HKEAA’s expenditure on complying with a data access request should have been reduced, including some items of the labour costs should have been saved, computer operating time costs should have been significantly reduced with the development of computer hardware and the exclusion of “printer operating and maintenance costs”; and other costs such as “paper and stationery costs” should also have been saved;
(2) Another complainant also considered that the provision of the requested data by way of email did not involve “printer operating and maintenance costs” and “paper and stationery costs”;
(3) Two complainants were of the view that the HKEAA had saved photocopying cost by providing the requested data in electronic form. According to the complainants’ estimation, the total number of pages of the document requested by him was much more than 10 pages and the relevant photocopying cost was much more than HK$20. Therefore the complainants considered that the reduction in the fee imposed on the electronic copies was not reasonable.
Complaint Matter (II)
One of the complainants further considered that as HKEAA had already retained scan copies of the candidates’ personal data, it should have been able to provide electronic copies of the data to the data access requestors. However, between 2012 and 2022, notwithstanding that the HKEAA was able to provide electronic copies of the requested data, it still chose to comply with data access requests by providing hard copies of the data at a higher cost and calculated the fees imposed on that basis. As such, the complainant lodged a complaint against the HKEAA for contravening section 28(4) of the Personal Data (Privacy) Ordinance (PDPO), that is, the fee imposed by the HKEAA for complying with a data access request was higher than the lowest fees the HKEAA imposed for complying with the request in other form.
Investigation Findings
Complaint Matter (I)
According to section 28(3) of the PDPO, no fee imposed for complying with a data access request shall be excessive.
The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-ling, completed the investigations into the four complaints after five rounds of enquiries. Based on the information obtained from the investigations and the relevant facts, the Privacy Commissioner found that the fees imposed by the HKEAA for complying with the data access requests were lower than the necessary and directly related costs incurred in complying with the data access request. Such costs included labour costs, computer operating time costs and other costs, but did not include “printer operating and maintenance costs” and “paper and stationery costs”. As such, the Privacy Commissioner found that the fees imposed by the HKEAA for complying with the data access requests were not excessive and the HKEAA had not contravened section 28(3) of the PDPO.
Complaint Matter (II)
For complaint matter (II),
section 28(4) provides that, if a data user may comply with a data access request by supplying a copy of the personal data to which the request relates, and the copy can be provided in one of 2 or more forms, the data user shall not, and irrespective of the form in which the data user complies with the request, impose a fee which is higher than the lowest fee the data user imposes for complying with the request in other form.
According to the information provided by the HKEAA, between 2012 and 2022 when the HKEAA handled data access requests, all the requested data was provided in hard copies. At the material time it was not feasible and secure to provide electronic copies to candidates directly. The HKEAA was thus unable to provide copies of marking records and examination scripts by means other than hard copies between 2012 and 2022.
The Privacy Commissioner found that the requirement under section 28(4) of the PDPO is premised on the fact that a data user may provide a copy of the personal data to which a data access request relates in one of 2 or more forms.
As the HKEAA could only provide copies of the relevant data in one form (that is, in the form of hard copies) between 2012 and 2022, section 28(4) of the PDPO was therefore not applicable. The Privacy Commissioner considered that complaint matter (II) was not substantiated. In other words, the HKEAA had not contravened section 28(4) of the PDPO.
Relevant Provisions under the PDPO
According to section 28(3), no fee imposed for complying with a data access request shall be excessive.
Section 28(4) provides that, if a data user may comply with a data access request by supplying a copy of the personal data to which the request relates, and the copy can be provided in one of 2 or more forms, the data user shall not, and irrespective of the form in which the data user complies with the request, impose a fee which is higher than the lowest fee the data user imposes for complying with the request in any of those forms.
For further information about the handling of data access requests, please refer to the PCPD's Guidance Note “Proper Handling of Data Access Request and Charging of Data Access Request Fee by Data Users”:
https://www.pcpd.org.hk//english/resources_centre/publications/files/dar2020_e.pdf
Download the Investigation Findings “Complaints by Hong Kong Diploma of Secondary Education Examination candidates against the Hong Kong Examinations and Assessment Authority about Excessive Fees Imposed for Accessing Marking Records and Examination Scripts”:
https://www.pcpd.org.hk/english/enforcement/commissioners_findings/files/r24_11302_e.pdf