Table of Contents Table of Contents
Previous Page  72 / 192 Next Page
Show Menu
Previous Page 72 / 192 Next Page
Page Background


In an investigation conducted by the Commissioner,


the Inland Revenue Department

(“IRD”) was found to have failed to take all practicable steps to ensure the accuracy of

a taxpayer’s address. The IRD received a request for change of address from the

complainant and an officer of the IRD inadvertently input the complainant’s new

address into the database as the address reported by another taxpayer. As a result, the

tax demand note was sent to the wrong address and was returned by the post office. In

an attempt to rectify the mistake, another IRD officer input the wrong flat number in the

complainant’s address. The tax demand was again sent to a wrong address. The

mistake was not discovered until the complainant sent an email to the IRD complaining

about non-receipt of the tax demand note. The multiple human errors in this case

reflected the lack of awareness of data accuracy not only on the part of a single staff

member but across different units of the IRD. Considering the sensitive nature of the

personal data used for tax purposes, the Commissioner took the view that the IRD should

have adopted a higher degree of care in handling taxpayers’ personal data, and the

IRD was found to have contravened DPP2(1). As a result, the IRD revised its procedures

to eliminate the incidents of mismatching of data when a request for address change

was received and strengthened the daily supervisory checking to ensure compliance by

its staff of the procedures, guidelines and checklists issued by the IRD to ensure data



In contrast, complaints may be lodged with the Commissioner by one individual against

another involving an ongoing dispute about the “inaccuracy” of allegations, sometimes

defamatory in nature, made by one party against the other concerning certain events

which may arguably be his personal data. In this regard, the Commissioner would, in

general, decline to investigate such type of cases, insofar as the true essence of the

complaint lies not so much in the inaccuracy of personal data held, but in the dispute

between the parties.


It is the court or tribunal of competent jurisdiction, rather than the

Commissioner, that is the appropriate forum for adjudicating such a dispute. The same

applies where the individual, having taken the further step of making a data correction

request to the other party, complains to the Commissioner about the refusal to “correct”

the data in the way he wanted. Comments made about a particular employee in a

dismissal letter are inherently contentious and the appellant in AAB No. 22/2000 sought

to correct the comments by making a data correction request. The AAB dismissed the

appeal and ruled that the proper channel for redressing the dispute was to commence

proceedings in the Labour Tribunal, not by way of a data correction request. (For further

discussion on data correction requests, readers are referred to Chapter 11).


In AAB No. 14/2011, a patient took out a claim in the Small Claims Tribunal against a

hospital for compensation. He obtained two medical reports from the attending doctor

and disputed the accuracy of the symptoms described of him as recorded in the reports.

The Commissioner refused to carry out an investigation as the alleged inaccurate

information was the medical opinion of the doctor and the Commissioner was not in a

position to determine its accuracy or otherwise. The AAB upheld the Commissioner’s


See Investigation Report No. R11-11778, available on the Website:


Under section 39(2)(ca) of the Ordinance, new statutory grounds were provided for the Commissioner to refuse to carry

out or decide to terminate an investigation if he is of the opinion that the primary subject matter of the complaint is not

related to the personal data privacy of individuals.