Table of Contents Table of Contents
Previous Page  8 / 192 Next Page
Show Menu
Previous Page 8 / 192 Next Page
Page Background



Information not represented in any document (hence not constituting personal data)

may be found in situations where, for example, there is real-time CCTV monitoring of

activities without the recording function being switched on, and information committed

to a person’s memory or information spoken (but not recorded). The question whether

verbal utterance amounts to disclosure of personal data was considered in AAB No.

21/1999 where a civil servant came to know certain sensitive personal information about

the complainant through handling the complainant’s complaint. Since there was no

evidence to prove that the sensitive personal information ever existed in a recorded

form, the AAB ruled that no personal data was involved and thus the case fell outside

the jurisdiction of the Commissioner. In AAB No. 6/2004, the verbal replies (not recorded)

given by certain employees to the employer in relation to the number of private

telephone calls made by a particular staff member and the contents thereof did not

constitute personal data of that staff member.

Definition of “Personal Data”


The definition of the term “personal data” is provided under section 2(1) of the

Ordinance as follows:

“ personal data” means any data –

(a) relating directly or indirectly to a living individual;

(b) from which it is practicable for the identity of the individual to be directly or indirectly

ascertained; and

(c) in a form in which access to or processing of the data is practicable.”


As explained above, the meaning of the term “data” is reasonably clear. Whether any

data constitutes personal data, therefore, depends on whether such data satisfies all of

the three conditions laid down in paragraphs (a), (b) and (c) in the definition of personal

data. However, given the generic nature of the terms used in those paragraphs, it is not

surprising that uncertainty may sometimes arise in their application as discussed below.

Paragraph (a) — “Relating Directly or Indirectly to a Living Individual”


The condition laid down in paragraph (a) in the definition of personal data requires the

data in question to be “relating directly or indirectly to” a living individual. However,

given that the concept of “relatedness” is very much a matter of degree, this may give

rise to difficulty in the application of paragraph (a).


The question of “relatedness” was considered by the UK court in detail. In Durant v

Financial Services Authority [2003] EWCA Civ 1746, it was held that what constituted

information that related to an individual being personal data was:

• whether the information was biographical in a significant sense; and

• that the information should have the individual as its focus rather than some other