Table of Contents Table of Contents
Previous Page  74 / 192 Next Page
Show Menu
Previous Page 74 / 192 Next Page
Page Background

DPP2(2) and Section 26


Data Protection Principle 2(2) provides as follows:

(2) All practicable steps must be taken to ensure that personal data is not kept longer than

is necessary for the fulfillment of the purpose (including any directly related purpose) for

which the data is or is to be used.


The Amendment Ordinance made changes to DPP2(2) by clarifying that a data user is

only required to take all (reasonably) practicable steps to comply with this data

retention principle. The amendment brings about a consistent legislative requirement in

respect of the duties that are imposed upon a data user under DPP2(1) and DPP2(2).

Before the law was amended, DPP2(2) had generally been interpreted to impose an

absolute duty on the data user to ensure that personal data was not kept longer than is

necessary. Similar amendments were made to section 26(1) concerning erasure of

personal data no longer required, which provides as follows:

26(1) A data user must take all practicable steps to erase personal data held by the data

user where the data is no longer required for the purpose (including any directly

related purpose) for which the data was used unless –

(a) any such erasure is prohibited under any law; or

(b) it is in the public interest (including historical interest) for the data not to be erased.


In connection with the penalty for contravention of section 26(1), it is relevant to note

section 64A(1) of the Ordinance which provides as follows:

(1) A data user who, without reasonable excuse, contravenes any requirement under this

Ordinance commits an offence and is liable on conviction to a fine at level 3.


Section 64A(1) does not apply to a contravention of a DPP and section 26(1) does not

relate to a DPP. A contravention of section 26(1) without reasonable excuse constitutes

an offence under section 64A(1). Thus, backed by section 26(1), DPP2(2) seems to

impose a more stringent obligation on the data user than the other DPPs (except for

DPP6, which is backed by parallel provisions in Part 5 of the Ordinance, as discussed in

Chapters 10 and 11).


The central concept, by reference to which both DPP2(2) and section 26(1) operate, is

the purpose for which the data in question was, or is to be, used. Indeed, the concept of

purpose is important not only for the operation of DPP2(2) and section 26(1), but also for

the operation of the other requirements under the Ordinance. How the permitted

purposes of use are to be ascertained will be discussed in detail in Chapter 7.


In the absence of any statutory requirements or strong evidence supporting a genuine

need for a data user to do so, the Commissioner is unlikely to accept retention of

personal data indefinitely. In a case handled by the Commissioner in 2008, a former

insurance agent abandoned copies of a huge amount of documents containing

personal data of the agent’s former clients collected more than four years ago. The