FAQs

Personal data is recorded information, including expressions of opinion, relating to an identifiable living individual, which are organised such that they can be processed or retrieved. Examples of personal data used in everyday life include a person's name, telephone number, fax number, address, sex, age, occupation, marital status, salary and financial status, religious belief, nationality, photo, identity card number, medical records and employment records, including assessments of employment performance.

No, apart from written documents, personal data in other forms, such as audio and video tapes, is also covered under the Ordinance.

Yes, the Ordinance covers personal information in any type of storage system, subject to it meeting the definition of personal data.

Basically yes, but there are certain exemptions from specific provisions of the Ordinance.. These have been provided for in order to maintain the convenience of everyday life and uphold certain social and public interests. One area of exemption relates to personal data held for domestic or recreational purposes. These are generally exempted from the requirements of the Ordinance.

To protect the public interest in such matters as security, defence, prevention or detection of crime, assessment or collection of tax, news activities and health, there are exemptions for data users from the requirements to grant access to individuals to their personal records and to limit the use of personal records to the original purpose at the time of the collection of information.

For employment-related records, there are certain limited exemptions from the requirement to comply with access requests from individuals. For example, some employment-related personal information held before came into effect is exempt from such access until 2002.

Yes, the Ordinance covers private sector and public sector, including Government departments. The Commissioner can carry out investigations in relation to data users in these sectors.

Generally speaking, a "blind" recruitment advertisement is one that does not identify either the employer or the employment agency acting on its behalf.

An employer or recruitment agency who clearly indicates its identity may ask job applicants to submit personal data in a recruitment advertisement, provided that the data are adequate but not excessive in relation to the purpose of recruitment and are to be used lawfully (section 2 of the Code).

An employer who collects personal data from job applicants without identifying itself, or an appointed recruitment agency, might have engaged in an act of unfair collection of personal data contrary to the requirement of Data Protection Principle 1(2) of the Ordinance ("DPP1(2)"). DPP1(2) provides that personal data should be collected by means which are fair in the circumstances of the case. It would generally be unfair for persons collecting personal data not to identify themselves when collecting personal information. Secondly, personal data collected from job applicants are subject to access and correction by the person concerned. Unless exempted from doing so under the Ordinance, an employer is required to provide a copy of the data no later than 40 days after receiving a data access request. Job applicants would not be able to exercise their data access rights if they are denied the identity of the organisation who collects their personal data (clause 2.11 of the Code).

No. The practice of employers providing a fax number, postal address or e-mail address in a recruitment advertisement is perceived as a way of inviting job applicants to submit their personal data and is not permissible under the provisions of the Code.

Learn more:

Code of Practice on Human Resource Management

Understanding the Code of Practice on Human Resource Management - Frequently Asked Questions About Recruitment Advertisements

Regulation on data protection in direct marketing

Part VIA of the Ordinance regulates the use and provision for use of personal data in direct marketing activity.

Data user (Bank A) is required to inform the data subject (you as a client of the bank) certain prescribed information and to obtain his consent. Prescribed information include the notification that the data user intends to use your personal data in direct marketing; that it will not so use your personal data unless it has received your consent or indication of no objection; the kinds of personal data to be used; and the classes of goods, facilities or services that it will promote to you.

The data user should also provide the data subject with a response channel to communicate his consent or indication of no objection. Non-response of the data subject to the data user's notification does not constitute consent or an indication of no objection. The data user cannot use the data subject's personal data in direct marketing unless it has obtained the consent or an indication of no objection from the data subject.

Failure to comply with the new requirements by the data user is a criminal offence punishable by a fine and imprisonment.

When you receive a marketing message, ask yourself:

Had the organisation sent you direct marketing messages before 1 April 2013 regarding the same kind of products it currently promotes, and you had never rejected those messages?

YES – Bank A may invoke the grandfathering provisions of the Ordinance. In which case, it can continue to use your personal data for the purpose of direct marketing the same class of products, without having to inform you of the prescribed information and obtain your consent or indication of no objection.

NO –Bank A may commit a breach of the new requirements if it had not obtained your consent or indication of no objection for using your personal data in direct marketing the current type of products. You may ask Bank A to remedy the breach or lodge a complaint to the PCPD.

You can opt out at anytime

As a data subject, you can opt out from direct marketing at anytime whether or not you have previously consented to receiving direct marketing messages.

Although the Ordinance does not prescribe the manner of how a data subject should raise an opt-out request, the PCPD advises data subject to do so in writing for better protection. You should keep a copy of it which can serve as evidence for future investigation.

If, after you have made an opt-out request and the organisation still keeps on using your personal data for direct marketing purpose, it may have committed an offence under the Ordinance.

Learn more:

Exercising Your Right of Consent to and Opt-out from Direct Marketing Activities under the Personal Data (Privacy) Ordinance

Infographic: It is Your Choice to Accept or Refuse Direct Marketing. File a Complaint Against Failed Opt-Out Requests

How to Make a Complaint

Having approached both organizations, it was clarified that the telephone company would only provide to FSD the telephone number and installation address of the numbers concerned, i.e. the building or the estate from which the call is made. No full address and name of the subscriber would be disclosed to FSD.

According to section 2 of the Ordinance, personal data means any data relating directly or indirectly to a living individual and from which it is practicable for the identity of the individual to be directly or indirectly ascertained. As the information passed over by the telephone company to FSD do not contain any personal identifying particulars such as name and full address, these data are not regarded as personal data and this arrangement would not be in breach of the Ordinance.

Before deciding to monitor, employers should first assess whether it is really necessary to conduct such activity having regard to the business risks that they seek to manage and the impact on personal data privacy of its employees. Employers should consider alternatives available in order to lessen the adverse impact brought by the monitoring activity. In carrying out monitoring, employers should also implement clear Employee Monitoring Policy and communicate it to the staff affected. The use, retention and processing of personal data collected should also be kept under control so as not to contravene the requirements under the Ordinance.

Learn more:

Privacy Guidelines: Monitoring and Personal Data Privacy at Work

The same assessment process as mentioned above also applies. Given that the workplace is also the place of rest for the domestic helpers, employers should seriously consider whether it is really necessary to engage in such activity, the reasonableness as well as the openness of the activity. They should therefore inform their helpers of such practice, restrict monitoring to targeted areas (not toilets or other private areas) and make clear the purpose of monitoring and the retention period for the taped records.

Learn more:

Monitoring and Personal Data Privacy at Work: Points to Note for Employers of Domestic Helpers"

Covert monitoring is not encouraged especially when it is being used as preventive measure only. Unless justified by existence of relevant special circumstances, such as "a reasonable suspicion" of unlawful activity and there is no reasonable alternative, this should only be engaged in as a last resort.

Guidance on CCTV Surveillance and Use of Drones

They can complain to the Privacy Commissioner, who can follow up with the employer and examine the case by reference to the recommended good practices suggested in the Guidelines. If the employer is uncooperative and the law on personal data protection has been breached, the Commissioner may serve an enforcement notice on the employer directing for remedial action, which, if not complied with, can attract criminal sanction.

Learn more:

How to Make a Complaint

We will not comment on individual cases before understanding the specific situation.

According to the Ordinance, "personal data" are any data relating to a living individual, which are stored in recorded form making access to or processing practicable and from which it is practicable for the identity of the individual to be directly or indirectly ascertained from it. Generally speaking, to constitute an act of collection of personal data by the data user, there should be compilation of information about an individual, whose identity must have been identified by the data user, or the data user intends or seeks to identify the identity of the individual.

In general, if a monitoring and recording system is installed in a public place merely for the sake of security, it may not constitute collection of personal data (unless the data of a certain or some particular individuals are collected) and it may not be subject to the Ordinance. However, collection of personal data may take place under some special circumstances. For example, after a special incident has happened, the Authority concerned may need to review the video records for the purpose of ascertaining the identity of the individuals involved in the incident and it may then amount to collection of personal data. Therefore, organizations which intend to install monitoring and recording systems should, at least, post a notice in a prominent position near the installation, stating that the area is being monitored, the purposes of monitoring, as well as the ways of handling the records.

Broadly speaking, organizations can install monitoring and recording systems only if it is necessary for fulfilling their legitimate functions or activities, such as for security reasons, the monitoring of illegal acts (e.g. throwing objects from height, installation of closed-circuit televisions at hygiene blackspots by Team Clean), etc. Before an organization installs a monitoring and recording system, it is suggested that it should establish the collection purposes, evaluate the risks of monitoring, and consider if there is any other substitute that is less privacy intrusive in order to strike a balance between the protection of privacy rights of individuals and the smooth operation of the organizations.

When an organization has decided to install a monitoring and recording system, it is suggested that in the interest of transparency it should post a notice in a prominent position near the installation (the notice should be as close to the installation as practicable; the words should be clear and noticeable) so that sufficient notice is drawn to the public or the people affected hat their activities may be recorded and the reasons for collection of their personal data. The organizations concerned are suggested to formulate policies on video monitoring, and the persons who can access and view the contents of the tapes. Moreover, the organizations should also prescribe the retention period of the tapes and delete the data in the tapes accordingly, and steps shall also be taken to ensure that the tapes are securely kept.

In conclusion, when using monitoring and recording devices in public place, it is our view that a proper balance should be struck between the protection of public interests and personal data privacy. Data users should handle the issue in a fair and transparent manner giving due regards to the rights of personal data privacy.

Learn more:

Guidance on CCTV Surveillance and Use of Drones