Table of Contents Table of Contents
Previous Page  31 / 192 Next Page
Show Menu
Previous Page 31 / 192 Next Page
Page Background


The meaning of data being held, processed or used “solely on behalf of another

person” and not for one’s “own purposes” is of particular relevance.


For example, a janitor was engaged for the service of regularly disposing of documents

that might contain personal data. Unless it can be shown that he collected the personal

data that might be found in the documents for his own purposes, generally he is not

considered, merely by collecting documents that might contain personal data for the

purpose of disposal, to come within the definition of a data user. Another example is

found in the case of the warehouse operators providing storage cubicles for use by their

customers. Chattels and documents may be stored but the operators generally have no

intention to collect the personal data that is found in these documents.


In AAB No.12/2013, a court clerk collected the personal data of a complainant before

taking notes in a magistrate’s court room. Since the purpose of collection was for the

management of the court but not for the court clerk’s own purpose, the AAB took the

view that the court clerk was not the data user.



Nowadays, the use of a third party contractor, such as a cloud service provider to store

electronic data on behalf of individuals and companies has become increasingly

popular. If the cloud service provider simply provides an electronic storage medium but

does not have any intention to collect the personal data which may be transmitted to it

for storage, it is to that extent not a data user as excluded under section 2(12).


By the same token, a service company providing secretarial services to a number of

shelf companies/individuals using its premises as a registered office is not a data user

when its staff collects incoming mail addressed to named individuals. This is because the

service company does not have its own purpose to serve in collecting the personal data

contained in the mail.


The requirements of the Ordinance do not apply to a person who is not a data user by

operation of section 2(12). However, an organisation engaging the services provided by

such person as an agent may be liable as principal under section 65(2) of the

Ordinance in respect of the personal data that was entrusted to the agent for handling.

Meaning of “Person” in the Context of Data User


Although one would expect that the Ordinance primarily seeks to address the abuse of

personal data by institutional data users, there is nothing in the definition of “data user”

to confine its meaning to institutions alone. Accordingly, insofar as an individual “controls

the collection, holding, processing or use” of personal data, the individual is a data user

in relation to the personal data and will consequently be subject to the full force of the

requirements under the Ordinance.


Another point to note in relation to the interpretation of “data user” is the meaning of

the word “person” and whether it extends to cover the Government as well. In this

connection, reference could be made to the interpretation of the word “person” as



AAB No.232/2013

, it was ruled that a rock climbing club, instead of the trainer retained by the club to provide training

and sign the certificate of completion of training, was the data user in question.