Table of Contents Table of Contents
Previous Page  16 / 192 Next Page
Show Menu
Previous Page 16 / 192 Next Page
Page Background

facial images) and behavioural data which are characteristics developed by an

individual after birth (examples include handwriting pattern, typing rhythm, gait and

voice pattern).


They are sensitive in nature, considering that they are not artificial

information which can be rendered obsolete when the individual finds necessary. For

instance, an individual whose wallet is stolen may apply for cancellation or renewal of a

credit card immediately, but in no circumstances can an individual be disconnected

from his unique biometric data.


While it may not be reasonably practicable for a lay person to ascertain the identity of

an individual by merely looking at the individual’s fingerprint images or their numeric

representations, when the biometric data is linked with personal data in another

database, a particular individual can be identified. In one complaint, a company

installed a fingerprint recognition system to record attendance of its staff. Instead of

collecting the fingerprints of the staff, the system collected certain features of the

fingerprints and converted the features into numeric representations for record purposes.

The Commissioner’s view was that although the system adopted by the company did

not collect the whole image of the fingerprint, the system could ascertain the identity of

the staff by linking the features of the fingerprints with other identifying particulars held

by it and so the data collected was personal data as defined by the Ordinance.


Examination Scripts


Students’ answers to examination questions generally do not relate to the students and

hence are not the students’ personal data. If an examination script was marked with the

examiner’s comments or an evaluation of the student’s answers, those comments and

evaluation would be the student’s personal data. In AAB No.7/2007, the AAB held the

view that in general an answer given by a candidate in an examination did not amount

to personal data of the candidate, but “if an examination script of the appellant was

marked with the examiner’s comments or evaluation of the appellant’s answers, that

examination script would be a document containing personal data of the appellant”.


The rationale of the above AAB decision was followed by the Commissioner in handling

a complaint lodged by a student who made a data access request to a University for

copies of his examination answer books and coursework. The University refused to

comply with the data access request on the grounds that the requested documents

were not the student’s personal data as the identity of the student was never an item of

information that affected their comments and marking. The Commissioner took the view

that evaluation of the performance of a student in an examination constituted the


See Case Note No. 2005C12 (available on the Website: ure=&msg_id2=257 )

, in which the Commissioner accepted fingerprints as personal data.


See the

Guidance on Collection and Use of Biometric Data

, available on the Website: .


See Investigation Report No. R09-7884, available on the Website: df .