Table of Contents Table of Contents
Previous Page  127 / 192 Next Page
Show Menu
Previous Page 127 / 192 Next Page
Page Background

What Other Information Is Recommended to Be Made Available


If a data user intends to collect personal data from young people and/or its website

contains content of interest to young people, it is recommended that a statement on its

practices in relation to the collection of personal data from young people be included

in its PPS. Generally, data users are not advised to collect personal data from minors

without prior consent from a person with parental responsibility for the minor.


If technical means such as cookies are used to collect information from individuals

without their knowledge, the data user should include statements on this practice in the

PPS. Matters that should be covered in the PPS include when such means are used,

what information is collected and if personal data is collected, what the purposes of use



The PPS may state in general terms for how long the personal data collected will be

retained. It is advisable that information be given on how deletion of data is done and

whether the personal data so deleted is permanently removed from the system.


If a data user collects sensitive personal data, such as data relating to health or finance,

the data user should explain how it uses, processes, handles and transfers such data. If

personal data will not be disclosed to other persons without the data subject’s express

and voluntary consent, it is advisable for such policy to be stated in the PPS. If personal

data will be disclosed to third parties or if the website will share visitors’ details (such as IP

addresses and browser types) with other persons, all such practices should be made

known in the PPS.


It is also good practice for the data users to state in the PPS how they ensure the security

and proper access to the personal data collected, for instance, whether access to

personal data is restricted on a “need-to-know” basis and whether encryption is applied

to protect the personal data. This practice assures data subjects that their personal data

is duly protected. If personal data will be outsourced to an agent or a data processor for

handling on behalf of the data user, the PPS may include a statement on how the

personal data will be transferred to such third parties and the personal data protection

measures that will be adopted.


For the sake of transparency, it is advisable for a data user to state in the PPS its policy in

handling a data access or correction request from an individual. It should include

information on how the data user prefers to receive such requests, what the data user

requires in order to be satisfied that the requestor is properly authorised and entitled to

make the request, and the amount of fee payable, if any.


The PPS may also include the contact details, for example, the office address, email

address, telephone number, etc. of the officer in the data user’s organisation who will

answer enquiries regarding the data user’s privacy policies and practices.

The Exercise of the Commissioner’s Enforcement Powers under Section 50


Section 50 was revised under the Amendment Ordinance to empower the

Commissioner to serve an enforcement notice directing the data user who is found to