Table of Contents Table of Contents
Previous Page  29 / 192 Next Page
Show Menu
Previous Page 29 / 192 Next Page
Page Background

or processing of the data contained in the document” and there was no evidence to

show a breach of DPP4 when the document was lost in transit.


Mere physical possession of a newspaper or magazine does not render the reader a

data user in relation to the personal data of individuals mentioned in the newspaper or

magazine. However, the situation might be different if the reader of the newspaper or

magazine intends to compile information about an identified individual, for example, a

celebrity or public figure for the purpose of, say, subsequent publishing of a dossier

about that person. It might then be argued that the reader became a data user

through his act of collection of the personal data in question.


While Eastweek is the landmark case which judicially defines the word “collect” and

therefore has an important bearing on the meaning of the term “data user”, there was

an earlier AAB decision on the issue of the meaning of “data user”. The AAB came to the

same conclusion as was reached at the subsequent Eastweek case. In AAB No. 4/1997,

a hospital employee lodged a complaint about an incident in which three hospitals had

permitted an open letter written by an employee, which contained the personal data of

the complainant, to be posted on their noticeboards. On appeal, the AAB upheld the

Commissioner’s decision not to investigate the case further. The AAB further observed:

Even if the hospitals had allowed or given consent for such posting, the hospitals could not be

taken as data users, since they only permitted the posting of the letters but they had no

control on the content or data mentioned in the open letter.


If one were to apply the Eastweek rationale to this AAB case, it might be argued that by

not having compiled information about the complainant, the hospitals did not “collect”

the complainant’s personal data in the Eastweek sense, which as a result, did not render

the hospitals “data users” vis-à -vis the personal data in question.

Meaning of “Data User” with Reference to More Recent AAB Cases


In the case of AAB No. 55/2006, an individual, on behalf of an organisation, wrote two

letters to a regulatory body concerning a complaint against a company. The regulatory

body forwarded the two letters to the company for their reply to the individual directly.

The individual then asked the company for copies of those two letters together with the

covering letter from the regulatory body, but the company refused to comply.


individual complained to the Commissioner that, in contravention of section 19 of the

Ordinance, the company had failed to provide him with copies of the requested letters

within forty days of his request. The Commissioner found that:

• the company had received the two letters from the individual on behalf of the

organisation for the purpose of dealing with the complaint made to the regulatory


• the correspondence between the company and the regulatory body was about the

complaint and did not concern the individual personally; and

• there was no collection of personal data about the complainant by the company

and therefore the Ordinance did not apply.