Table of Contents Table of Contents
Previous Page  82 / 192 Next Page
Show Menu
Previous Page 82 / 192 Next Page
Page Background

The Lawful Functions and Activities of the Data User


As prescribed in DPP1(1), personal data shall be collected for a lawful purpose directly

related to the data user’s function or activity. Thus, the lawful function and activity of the

data user is a primary factor in deciding whether the use is proper, particularly in

situations where no PICS is given or where the drafting of the PICS is ambiguous. For

example, where the personal data of job applicants is received in a recruitment

exercise by company A (not being an employment agency), the referral by it of such

job applications to unrelated parties or other prospective employers without the job

applicants’ consent may exceed its normal functions and activities and thus constitute a

new purpose of use.


However, sometimes the function or activity of the data user may entail the disclosing of

personal data to another party. In a complaint that came before the Commissioner, flat

owner A repeatedly complained to the management company about water dripping

from the flat owned by B. As a result of the complaint, the management company

collected the personal data of B and, upon the request of A, the personal data was

disclosed to A who subsequently commenced civil proceedings against B. On appeal in

AAB No. 66/2003, the AAB upheld the Commissioner’s finding that since B’s personal

data was collected for the purpose of handling and following up on the dispute in

question, the disclosure of B’s personal data by the management company to A was for

a purpose consistent with the original purpose of collection and hence no prescribed

consent from B was required prior to the disclosure.


Another example can be found in AAB No.25/2012, where an enquiry made by the

complainant to a government department was referred by that government

department to the Judiciary, as it believed that the subject matter of the enquiry fell

within the Judiciary’s purview. The AAB affirmed the Commissioner’s view that by

forwarding the email containing the enquiry to the Judiciary for their information, the

government department was referring the enquiry to the appropriate department for

further handling and was using the data for the purpose for which it was intended at the

time of collection, namely to deal with the complainant’s enquiry.


It can be seen from the examples provided that the function and activity of a data user

is of particular relevance in ascertaining the lawful purpose of use of personal data. It is

especially so in relation to unsolicited data or data provided by third parties.

Restrictions of Use Imposed upon Data User by Data Provider or Data Subject


On some occasions, the person who provides the data (who may be the data subject

himself or a third party) may make an express stipulation on the use of the personal data.

Generally speaking, if the recipient has no intention to compile information about the

individual in the Eastweek sense,


such restrictions on use imposed, if any, might not

have a part to play and the Ordinance has no application as the recipient did not

collect the personal data in question. However, if the recipient subsequently compiled

information about the individual whom it has identified or intends to or seeks to identify,

the restrictions on use imposed by the data provider may then become a relevant

factor for consideration.


See Chapter 3.