Table of Contents Table of Contents
Previous Page  133 / 192 Next Page
Show Menu
Previous Page 133 / 192 Next Page
Page Background

by the data subject), evidence showing the requestor’s parental relationship with the

data subject who is a minor, or evidence showing that the requestor is the lawful

guardian or person appointed by the Court to manage the affairs of the data subject

who is incapable of managing his affairs. If a data user cannot reasonably establish the

relationship between the requestor and the data subject, the data user must refuse to

comply with the data access request.


Section 18(1) provides that a relevant person may make a data access request on

behalf of a data subject. The provisions of the Ordinance, however, give no indication,

of the kind of situation in which a data access request made by a relevant person is to

be regarded as being so made “on behalf of” the individual. Doubt may arise as to

whether a data access request is properly made by one of the parents as a relevant

person on behalf of a minor in the following two situations: first, where the parent is

physically separated from the minor, so that one may suspect the data access request is

in fact made by the parent for his own purposes, so as to enable himself to locate the

minor or the other parent of the minor rather than on behalf of the minor; secondly,

where the minor could well be disinclined, if asked, to have his data released to the



For example, a parent who has been denied physical access to his child by the Court or

the custodian parent may try to lodge a data access request under the Ordinance with

a social welfare organisation or the child’s school, seeking to obtain the personal data

of the child, on the basis that he is the

relevant person

of that child. However, from the

subject matter raised in the request (e.g. a request for information on the whereabouts

of the child which is obviously known to the child in question) it may be argued that the

parent requesting the data is making the data access request for his own benefit, rather

than in the child’s interest. In situations like these, the Commissioner will be inclined to

take the view that the request is not made “on behalf of” the child and does not

therefore satisfy the requirements under section 18(1) of the Ordinance.

How to Make a Data Access Request?


The Ordinance does not prescribe any particular form or mode by which a data access

request may be made. However, under sections 20(3)(a) and (e), if a data access

request is not made “in writing in the Chinese or English language” or the request is not

made in the form prescribed by the Commissioner, these may constitute valid grounds

on which the request may be refused. Even so, the data user is still bound to comply with

the requirements applicable to such a refusal, as will be discussed in paragraphs 10.78 to

10.83 below.


Cases handled by the Commissioner suggested that the absence of any prescribed

form for a data access request often caused confusion. In particular, a data user

receiving such a request could easily be unaware of it being a data access request,

hence failing its obligation to respond to it in strict compliance with the Ordinance. This

has a significant impact on data users who have regular dealings with individuals. Even if

a request is not meant to be made pursuant to the Ordinance (for example, a request

made to a government department pursuant to the Code of Access to Information), the

requested information may happen to contain the requestor’s personal data.