Table of Contents Table of Contents
Previous Page  89 / 192 Next Page
Show Menu
Previous Page 89 / 192 Next Page
Page Background

the use of the personal data as stated in the search records was confined to

transport and traffic matters and did not include the use of the personal data for

commercial benefits; and

the complainant’s reasonable privacy expectation when providing his personal

data to the Transport Department did not extend to cover the use of his personal

data in direct marketing.

Since the use of the personal particulars of the complainant in question for direct

marketing was entirely unrelated to transport and traffic matters, the Commissioner found

the act in question a contravention of DPP3.

Purposes Directly Related to the Original Purpose of Collection


DPP3(4)(b) allows personal data to be used for a purpose directly related to the original

purpose of collection. This makes sense as in many cases not all purposes of use of

personal data can be definitively stated on or before the collection of the personal

data by the data user. The concept of “directly related purpose” is of great practical

significance, without which the use of personal data for various incidental and

innocuous purposes by the data user may be hampered.


In assessing whether the act in question is done for a “directly related purpose” and thus

covered by DPP3(4)(b), the Commissioner will take into account factors such as:

• the nature of the transaction giving rise to the need to use the personal data; and

• the reasonable expectation of the data subject.


The need of the transaction in question is regarded as relevant because one would

expect that a data subject provides his personal data in order to enable or facilitate the

transaction with the data user. It would therefore be within the reasonable

contemplation of the data subject that the use of his personal data will consist of all

such uses as would be necessary to effect the intended transaction. In AAB No. 24/2009,

the complainant was named as a referee by his son in a loan application which was

submitted to an intermediary for the approval of the loan by a finance company. The

complainant complained to the Commissioner against the disclosure of his personal

data by the intermediary to the finance company. Having considered the nature of the

transaction, the Commissioner took the view that the disclosure of the referee’s personal

data to the finance company was for a directly related purpose, i.e. for processing the

loan application and hence was consistent with DPP3. The decision of the Commissioner

was upheld by the AAB.


In another appeal AAB No.46/2014, a salaried partner of a law firm complained against

the equity partners of supplying his personal data to a credit provider in a loan

application for the law firm as the borrower. The complainant maintained that he was

not made a borrower or guarantor personally in the application and hence his signature

was not required. The AAB accepted and agreed with the Commissioner that the

relevant personal data was provided by the equity partners to the credit provider for the

purpose of verifying the complainant’s identity as one of the partners of the law firm in

order to satisfy the due diligence measures under the Anti-Money Laundering and