The Personal Data Privacy Commissioner ("the Commissioner") is empowered to act in response to a complaint duly made under the Personal Data Privacy Ordinance ("the Ordinance") to require whatever information would be useful to assist him in review of the complaint.
The complainant had alleged that his personal data held by an employment agency which he had consulted for a new job had been transferred by the agency to a third party without the consent of the complainant.
This being, at least prima facie, a breach of a data protection principle as scheduled to the Ordinance, the Commissioner was well within his rights to seek further information.
Accordingly, a first attempt was made to obtain the information from the director of the data user employer agency and no response was received.
The Commissioner made a number of further attempts to contact the director all of which were unsuccessful.
Eventually, the Commissioner was driven to issue a summons against the director requiring him to appear for examination by the Commissioner.
A date was set by the notification to the director and the director failed to appear on the date set.
Accordingly the Commissioner informed the police that a criminal investigation was necessary under Section 50(B)(1)(b) of the Ordinance. This section provides that if any person receiving a lawful requirement of the privacy commissioner fails without lawful excuse to comply with it he commits a criminal offence.
In the Magistrates Court the director – who really had no option – pleaded guilty to the charge. A fine of HK$3,000.00 was imposed.
The objects lesson for the data user market is that the law means something and to flout it is not acceptable and the Commissioner is empowered to take the necessary action to enforce response by the data user to the Commissioner's duly empowered requirements.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.