Table of Contents Table of Contents
Previous Page  92 / 192 Next Page
Show Menu
Previous Page 92 / 192 Next Page
Page Background


This principle of non-disclosure of unnecessary and excessive data can be illustrated in

the self-initiated investigation by the Commissioner against employment agencies for

domestic helpers.


Having considered the unique job nature of foreign domestic

helpers who must reside in their employers’ residence and who have to interact

intimately with the employers’ family, the Commissioner accepted that the posting on

an employment agencies’ websites of job applicants’ photographs and background

information (including their build, age, work experience, education level, nationality,

habits (e.g. smoker or not), religion, marital status, number of children, number of siblings

and the applicants’ ranking among them) will facilitate initial screening by prospective

employers. However, the disclosure of the name, address and passport/HKID number of

the applicants and the personal data of their family members and past employers was

unnecessary and excessive. The Commissioner commented that, unlike presenting the

job applicant’s profile to the prospective employer in person when the latter visits the

agencies’ offices, the display of the job applicant’s personal data online is subject to

unrestricted access by unidentified third parties, who may copy the data, retain the

data permanently, integrate or correlate the data with other fragmented data of the

same person from different sources. The possible secondary use of such data is beyond

a person’s anticipation or comprehension and definitely very difficult to control.


The extent of disclosure of personal data was also considered in a complaint handled

by the Commissioner. A government department collected a witness statement for the

purpose of prosecuting an offender and the standard form witness statement contained

the personal particulars of the witness, such as his name, address, HKID number, date of

birth and place of employment, etc. The department furnished the unedited version of

the witness statement in its entirety to the defendant. While it was accepted that the

disclosure of the contents of the statement made by the witness to the defendant was

necessary for the defendant to answer the charge, the disclosure of such personal

particulars of the witness, such as his HKID number, address, date of birth and place of

employment, was not justified in the circumstances of the case. Based upon the findings

of the Commissioner, the government department concerned agreed to revise its

operation manual so that unnecessary personal particulars of the witness would be

redacted before the witness statement was sent to other parties to the proceedings.



A data user’s obligation to ensure that only necessary and relevant personal data

should be used or disclosed is best illustrated in the various scenarios of handling

property owners or occupiers’ personal data by property management companies and

owners corporations


discussed below.


See Investigation Report No.R14-1382, available on the Website:


A similar approach was adopted in

Wong Kar Gee Mimi v Hung Kin Sang Raymond & another

[2011] 5 HKLRD 241, which

is a case concerning the making of an application for inspection by a shareholder of a company on various documents.

The Court granted the application and under the proper purpose requirement, the applicant was entitled to inspect the

payroll records of the employees which were confined to the names and the amount of the employees’ salary. Other

personal data, i.e. the addresses, telephone numbers, HKID numbers, email details and bank account details of the

employees had to be blanked out.


See G

uidance on Property Management Practices

issued by the Commissioner, available on the Website: