Table of Contents Table of Contents
Previous Page  15 / 192 Next Page
Show Menu
Previous Page 15 / 192 Next Page
Page Background

Email Addresses


An email address identifies the destination (i.e. email box) to which email messages are

delivered. An email address (comprising alphanumeric characters) can be created

easily and quickly. Very often, an individual is free to create an email address which

does not reveal his full name or contain any clue as to his identity. It is therefore difficult

for the identity of an email address holder to be properly identified solely from an email



Whether an email address may constitute personal data of the email account holder

was considered in AAB No. 16/2007. In the appeal, the AAB stated that they did not

consider the email address of “huoyan_1989” to be the complainant’s name, nor was it

the complainant’s personal data.


In AAB No. 25/2008, the AAB decided that an email address in some circumstances

could be information from which the identity of an individual may be directly or

indirectly ascertained. However, the AAB did not accept that an email address

comprising the initials of the complainant was, without any further information, sufficient

to lead to the conclusion that the complainant’s identity would become reasonably

ascertainable from such an address. The AAB decided that the email address in

question was not the complainant’s personal data.


In AAB No.25/2012, the complainant sent an email enquiry to a government bureau

through the address <“Judiciary Hong Kong”>

and signed as

“Lau TL”. Subsequently, the bureau copied the reply email (attaching the complainant's

enquiry email) to the Judiciary for information without her consent. The AAB considered

that it was not practicable from the abbreviated name and email address (even when

read together) for the identity of the complainant to be directly or indirectly ascertained.

In any event, the fact that the complainant might have been known to the Judiciary

because of some unrelated previous events did not turn the abbreviated name and the

email address into personal data within the meaning of the Ordinance.

Biometric Data Such As DNA and Fingerprint Data


Biometric data possesses the characteristics of being both unique to the individual and



It includes physiological data which individuals are born with (examples

include DNA samples,




palm veins, hand geometry and iris, retina and


Description in the “Working Document on biometrics” adopted by Article 29 Data Protection Party of EU on 1 August

2003. The description was updated in the “Opinion 4/2007 on the concept of personal data” adopted by Article 29 Data

Protection Party of EU on 20 June 2007 which was followed in the “Opinion 3/2012 on development in biometric

technologies” adopted by Article 29 Data Protection Party of EU on 27 April 2012. According to these Opinions,

“biometric data” may be defined as “biological properties, behavioural aspects, physiological characteristics, living

traits or repeatable actions where those features and/or actions are both unique to that individual and measurable,

even if the patterns used in practice to technically measure them involve a certain degree of probability”.


See Case Note No. 2004C01 (available on the Website: ure=&msg_id2=221 )

, in which the Commissioner accepted DNA as personal data.