Table of Contents Table of Contents
Previous Page  148 / 192 Next Page
Show Menu
Previous Page 148 / 192 Next Page
Page Background


(d) subject to subsection (4), any other data user controls the use of the data in such a

way as to prohibit the first-mentioned data user from complying (whether in whole

or in part) with the request;

(e) the form in which the request shall be made has been specified under section 67

and the request is not made in that form;

(ea)the data user is entitled under this or any other Ordinance not to comply with the

request; or

(f) in any other case, compliance with the request may for the time being be refused

under this Ordinance, whether by virtue of an exemption under Part 8 or otherwise.


Section 20(3)(a) and (e) have already been discussed above.


Of the various other

grounds of refusal provided for in section 20(3), the one under paragraph (f) is the

broadest. In particular, Part 8 of the Ordinance provides for many situations in which

personal data is exempt from access by the data subject (which will be discussed in

Chapter 12). When a data user is uncertain whether any of the exemption provisions

apply to a particular case, the prudent practice is to seek independent legal advice

before relying upon the exemption to not comply with a data access request. The

Commissioner takes the view that refusal of a data access request on invalid grounds

(even if the data user subjectively believed them to be valid) technically constitutes

contravention of section 19(1) by the data user. The burden of proof lies on the data

user to properly invoke the exemption.


Of the remaining provisions in section 20(3), paragraph (d) also deserves mention. In fact,

this paragraph needs to be read in conjunction with sections 21(1) and 18(4), which

provide as follows:

Section 21(1)

(1) Subject to subsection (2), a data user who pursuant to section 20 refuses to comply with

a data access request shall, as soon as practicable but, in any case, not later than 40

days after receiving the request, by notice in writing inform the requestor –

(a) of the refusal;

(b) subject to subsection (2), of the reasons for the refusal; and

(c) where section 20(3)(d) is applicable, of the name and address of the other data

user concerned.

Section 18(4)

(4) A data user who, in relation to personal data –

(a) does not hold the data; but

(b) controls the use of the data in such a way as to prohibit the data user who does

hold the data from complying (whether in whole or in part) with a data access

request which relates to the data,


See paragraphs 10.19 to 10.24.