Important Notice to Data User
1. You are required by section 19(1) of the PDPO to comply with a data access request within 40
days after receiving the same. To comply with a data access request means: (a) if you hold the
requested data, to inform the requestor in writing that you hold the data and supply a copy of the
data; or (b) if you do not hold the requested data, to inform the requestor in writing that you do
not hold the data (except that the Hong Kong Police may inform the requestor orally if the
request is whether it holds any record of criminal conviction of an individual). A mere
notification given to the requestor to collect the requested data or a note sent to the requestor for
payment of a fee is insufficient. In complying with the request, you should omit or otherwise
not disclose the names or other identifying particulars of individuals other than the data subject.
2. If you are unable to comply with the data access request within the 40-day period, you must
inform the requestor by notice in writing that you are so unable and the reasons, and comply with
the request to the extent, if any, that you are able to within the same 40-day period, and
thereafter comply or fully comply, as the case may be, with the request as soon as practicable (see
section 19(2) of the PDPO).
3. If you have a lawful reason for refusing to comply with the request pursuant to section 20 of the
PDPO, you must give the requestor written notification of your refusal and your supporting
reasons within the same 40-day period (see section 21(1) of the PDPO).
4. It is an offence not to comply with a data access request in accordance with the requirements
under the PDPO. Any data user convicted of such an offence is liable to a fine at level 3
(currently set at HK$10,000) (see section 64A(1) of the PDPO).
5. You may charge a fee for complying with a data access request, but section 28(3) of the PDPO
provides that “no fee imposed for complying with a data access request shall be excessive”. The
PDPO does not define the meaning of “excessive” with regard to imposing a data access request
fee. According to the principle laid down in the decision of Administrative Appeal No. 37/2009,
a data user is only allowed to charge the requestor for the costs which are “directly related to and
necessary for” complying with a data access request.
6. You shall refuse to comply with a data access request –
(a) if you are not supplied with such information as you may reasonably require –
(i) in order to satisfy you as to the identity of the requestor;
(ii) where the requestor purports to be a relevant person, in order to satisfy you –
(A) as to the identity of the individual in relation to whom the requestor
purports to be such a person; and
(B) that the requestor is such a person in relation to that individual;
(b) subject to section 20(2) of the PDPO, if you cannot comply with the request without
disclosing personal data of which any other individual is the data subject unless you are
satisfied that the other individual has consented to the disclosure of the data to the
requestor; or