Voice

Under the Personal Data (Privacy) Ordinance, you have the right to request another party, for example, a government department or an organization, to confirm whether it holds any of your personal data and to request a copy of any such data. You also have the right to request it to correct any inaccurate data about you.

When making the data access request, you should use the Data Access Request Form issued by the Privacy Commissioner's Office. You should specify clearly in the form the information required so that the party concerned could process your request with minimum delay. If you do not use this Form, the party concerned may refuse to comply with your data access request.

Also, the party concerned may ask you to show proof of your identity such as your identity card or other identifying documents such as a staff card, medical card or student card. You may also be asked to provide further information to enable the location of the data you requested. In some cases, you may need to fill in other forms specified by the party concerned although it is not mandatory to do so.

Generally speaking, the party concerned is required to comply with your data access request no later than 40 days after receipt of your request and should provide you with a copy of the data requested. Even if the party concerned is unable to comply with your request within such a period or has valid grounds to refuse your request, it should reply to you within 40 days setting out the reasons for the refusal or its inability to comply with your request. If the party is unable to comply with your request within 40 days of its receipt, it should comply with it as soon as practical thereafter.

Please note that under the Ordinance, a fee can be charged by the party concerned for complying with a data access request. However, the fee must not be "excessive". That is, the party concerned should not charge more than the direct cost of complying with your request. If you believe that the fee charged for your access request is excessive, you should raise the matter with the party concerned. If you are not satisfied with its explanation, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data.

Furthermore, if the data provided in response to your request are incorrect, you can make a data correction request. Similar to data access request, the party concerned, on receipt of your data correction request, should respond within 40 days of the request. If your data correction request is complied with, the party concerned should provide you with a copy of the corrected data. If not, the party should inform you why your correction request is not complied with.

In case you have any query on the data access request, please call the Privacy Commissioner's Office Hotline on 2827 2827.

Date: 19th December 2002