Table of Contents Table of Contents
Previous Page  80 / 192 Next Page
Show Menu
Previous Page 80 / 192 Next Page
Page Background

What Amounts to Use?


“Use”, in relation to personal data, is defined in section 2(1) of the Ordinance to include

the disclosure or transfer of the data. In addition to the conventional examples of

disclosure or use (e.g. transferring personal data to another organisation, or posting the

personal data on a notice board), the uploading or posting of personal data on the

internet would also amount to disclosure and would fall within the scope of DPP3(1).

What Is a New Purpose?


“New purpose” is defined in DPP3(4):

(4) In this section –

new purpose, in relation to the use of personal data, means any purpose other than –

(a) the purpose for which the data was to be used at the time of the collection of the

data; or

(b) a purpose directly related to the purpose referred to in paragraph (a).


Any use (including disclosure or transfer to a third party) of the personal data, which is

not directly related to the original purpose for which the personal data was collected,

will amount to a “new” use calling for the prescribed consent of the data subject. Failure

to obtain the prescribed consent of a data subject prior to such use may contravene

the requirements under DPP3. Data users must ascertain the lawful and permitted

purpose(s) of use which is relevant not only in respect of the application of DPP3, but

also for the application of other purpose-related provisions of the Ordinance, such as

DPP1(3), DPP2(2), DPP5 and section 26.

The Original Purpose of Collection


DPP3(1) and DPP3(4)(a) allow the use of personal data for the purpose for which the

data was originally collected. In ascertaining the original purpose of collection, the

following factors are relevant for consideration:

• the explicit purposes stated in the PICS given under DPP1(3);

• the function or activity of the data user;

• the restrictions of use imposed by the data subject or the transferor of the data; and

• personal data collected in the public domain.

The Purposes of Collection Stated in the PICS


It was mentioned in Chapter 5 that DPP1(3) requires a data user, on or before the

collection of personal data from a data subject, to take all reasonably practicable steps

to ensure that the data subject is informed, inter alia, of the purpose for which his data is

to be used. The informed purpose obviously reflects the data user’s then expectation

regarding the use of the data collected. But to what extent does this also reflect the

expectation of the data subject?