Information Leaflet

Example of a Matching Procedure

Data user A is responsible for making payments to several thousand individuals who meet certain eligibility criteria. Data user A collects and uses the personal data of individuals applying for such payments for the purpose of determining whether they are eligible for the payments and arranging that the money be paid to those who are.

One of the eligibility criteria is that the individual should not own property. To check that the individuals meet this criteria, data user A compares the personal data collected with that contained in a register of property owners maintained by data user B. The register contains personal data collected by data user B for purposes related to conveyancing. The comparison of the first set of personal data held by data user A with the set of personal data held by data user B will confirm whether or not the individuals concerned own property.

As the number of individuals involved is large, data user A uses a computer programme to compare the personal data it holds with the personal data held by data user B to ascertain which of them own property. Any individual identified as owning property by this automated comparison has his or her application for payment declined or, in the case of existing recipient, the payments are discontinued.

Point to Note

This is a matching procedure because all four criteria of a matching procedures are met.

Examples of Comparison Procedures Falling Outside the Definition of Matching Procedure

Case A - Manual Checking of Computer Records

Data user C has collected personal data for purposes related to making employment appointments. Data user D maintains a register of personal data that has been collected for purposes related to ascertaining the residence status of individuals. Data user C provides the personal data, including the names and identity card number, of 20 selected candidates to data User D to check whether the candidates are Hong Kong residents before offering appointment to those candidates.

Upon receipt of the personal data from data user C, data user D enters the name and ID card number of each individual into its computer database as an access key to retrieve any record of personal data that relates to that individual. If such a record exists, data user D checks through the personal data in the record to determine whether or not the individual is a Hong Kong resident. The outcome of the check is then sent to data user C. Having received the reply, data user C decides whether or not to offer appointment to each candidate.

Point to Note

The above is not a matching procedure because the comparison process itself is carried out by manual, not automated means. Computer equipment is only used to retrieve the data concerned.

Case B - Updating of Personal Data

Data user E is the agent for a brand of air-conditioner. It collects personal data from its clients, who number many hundred, in order to provide a servicing service for the air-conditioners they have purchased. When data user E receives notice of changes in the personal particulars of its clients it updates its database. The processing of these changes may involve more than ten individuals at one time.

Point to Note

The above is not a matching procedure because it does not involve the comparison of two sets of personal data collected or used for different purposes, neither is any adverse action involved. It is simply an updating exercise using data collected for the same purpose as the data that are updated.