Table of Contents Table of Contents
Previous Page  189 / 192 Next Page
Show Menu
Previous Page 189 / 192 Next Page
Page Background


The data user would still be obliged to comply with section 18(1)(a)


upon receipt of a

data access request so made even though exemptions under sections 57 and 58 apply.

Section 63 is thus viewed as important in providing the data user with a statutory basis

insofar as the prejudice test therein laid down is satisfied to refuse to comply with a data

access request made under section 18(1)(a), giving a more complete and meaningful

application to sections 57 and 58.

Section 63A—Human Embryos, etc.


This exemption provides that if personal data consists of information showing that an

identifiable individual was, or may have been, born in consequence of a medical,

surgical, obstetric or other procedure assisting or otherwise bringing about human

reproduction by artificial means, such personal data is exempt from DPP6 and section

18(1)(b). The data is also exempt from section 18(1)(a) if the interest protected by that

exemption would be likely to be prejudiced by the disclosure of the existence or non-

existence of the data.

Section 63B —Due Diligence Exercise


This new exemption added under the Amendment Ordinance seeks to address the

practical needs of businesses to disclose or transfer information which may contain

personal data in an intended merger, acquisition or transfer of businesses for the

purpose of conducting a due diligence exercise by the proposed transferee. Such use

of personal data may not fall within the original or directly related purpose of collection

and the transfer of personal data in the absence of the prescribed consent of the data

subjects may contravene DPP3. However, obtaining prescribed consent prior to the

transfer will pose a hurdle to merger or acquisition activities which are very often time

sensitive. Moreover, there may be a genuine need to keep the transaction confidential

at the due diligence stage.


Data users who seek to invoke this exemption should be careful about the limited scope

of its application by paying particular attention to the definition of “due diligence

exercise”, the nature of the proposed business transaction, the amount of personal data

to be disclosed or transferred by the data users and the duty of the transferee to return

the personal data after completion of the due diligence exercise.


“Due diligence exercise” is defined under section 63B(6) to mean:

in relation to a proposed business transaction, the examination of the subject matter of the

transaction to enable a party to decide whether to proceed with the transaction


The scope of the exception is provided under section 63B(1) as follows:

(1) Personal data transferred or disclosed by a data user for the purpose of a due

diligence exercise to be conducted in connection with a proposed business

transaction that involves –


See Chapter 10 for further details.