Table of Contents Table of Contents
Previous Page  178 / 192 Next Page
Show Menu
Previous Page 178 / 192 Next Page
Page Background

Commissioner commented that it was the data user’s responsibility to properly assess

and consider whether the exemption under section 58(1)(d) and (2) could be relied

upon, i.e. that compliance with DPP3 would prejudice the purpose of section 58(1)(d).

The data user could not simply rely on the arguments made by the police.


Given the sensitive nature of most law enforcement operations, the data user may not

always be able to obtain clear proof that the prejudice test in section 58(2)(b) has been

satisfied. Nevertheless, it is still likely that the law enforcement agency may provide some

information, or confirmation of a general nature, on which the data user may

reasonably rely. The view generally taken by the Commissioner is that it is prudent for the

data user to make enquiries with the law enforcement agency on:

the purpose for which the personal data is to be used;

the reason why the personal data concerned is relevant to or necessary for the


the reason why the data subject’s consent is not obtained by the agency;

whether the personal data can be obtained from another source; and

in particular, how the application of DPP3 would be likely to prejudice the purpose.

By asking for more information, the data user is put in a better position to invoke the

defence under section 58(2) in any subsequent proceedings or complaint against it for

alleged contravention of DPP3 in the disclosure of the data.

Section 58A— Protected Product and Relevant Records under Interception of

Communications and Surveillance Ordinance


Section 58A exempts from the provisions of the Ordinance any personal data which is or

is contained in any communication or material (including their copies) obtained

pursuant to the prescribed authorisations given by the panel judges or the authorising

officer for interception and covert surveillance under the Interception of

Communications and Surveillance Ordinance. In addition, any personal data system

which is used by a data user for the collection, holding, processing or use of the relevant

personal data is exempted from the provisions of the Ordinance.

Section 59 —Health


Section 59(1) exempts personal data relating to the physical or mental health of a data

subject from the provisions of DPP3, DPP6 and section 18(1)(b), if the application of such

provisions to the data would likely cause serious harm to the physical or mental health of

the data subject or any other individual. The Amendment Ordinance introduced a new

subsection (2), which broadens the scope of section 59 to also exempt from DPP3

personal data relating to the identity and location of a data subject where application

of DPP3 would likely cause serious harm to the physical or mental health of the data

subject or other individual. When properly invoked, the newly added class of personal

data will assist data users to locate the data subjects, for example, in rescue actions.