Table of Contents Table of Contents
Previous Page  156 / 192 Next Page
Show Menu
Previous Page 156 / 192 Next Page
Page Background

(i) the data has been disclosed to a third party during the 12 months immediately

preceding the day on which the correction is made; and

(ii) the data user has no reason to believe that the third party has ceased using

the data for the purpose (including any directly related purpose) for which the

data was disclosed to the third party,

take all practicable steps to supply the third party with a copy of the data as so corrected

accompanied by a notice in writing stating the reasons for the correction.


The first point to note is that a data user is obliged to comply with a data correction

request only if it is “satisfied that the personal data to which the data correction request

relates is inaccurate”. For instance, if the data user is satisfied that the HKID number was

inaccurately recorded, it should make the necessary correction. If the data in question

was provided by a third party instead of being directly collected from the data subject,

the data user may need to consult the third party on the accuracy of such data.


Where the data user is not satisfied that the data was inaccurate, he may refuse to

comply with the data correction request in accordance with section 24(3)(b), to be

discussed in paragraphs 11.24 to 11.33 below.


Another point to note is that “correction”, in relation to personal data, is defined in

section 2(1) as meaning “rectification, erasure or completion”. How this has been

applied by the Commissioner is illustrated in a complaint case, in which the complainant

made a data correction request to a government bureau in relation to notes kept by

the bureau. The notes, being the record of an interview with a third person, contained

certain information about the complainant, which later proved to be inaccurate. The

complainant therefore requested the deletion of his data contained in the notes.


Instead of deleting the data in question, the government bureau entered a note in the

same file clearly pointing out the inaccuracy of the information. A copy of the note was

provided to the complainant. Also, a marker was added to the relevant file to refer the

reader to the note.


Although the complainant was dissatisfied with the manner in which his request had

been complied with, the Commissioner took the view that what the government bureau

had done was in effect “rectification” or “completion” of the relevant data, and as such,

amounted to adequate compliance with section 23(1). The manner of compliance was

regarded as more appropriate than simply deleting the data, as suggested by the

complainant, so as to preserve a true record of what the third person had actually said

in the interview, despite the inaccuracy of the information.


Except where there are valid grounds for refusing to comply with a data correction

request under section 24, a data user is required to make the necessary correction and

supply a copy of the corrected data to the requestor within forty calendar days after

receiving a data correction request.


If the data user is unable to comply with the data correction request within the specified

forty days, it must notify the requestor accordingly and comply with the request as soon

as practicable as provided under section 23(2):