Voice

The Personal Data (Privacy) Ordinance applies to data users, that is individuals or organizations who control the collection, holding, processing and use of personal data. A company or a governmental department can be a data user.

The Ordinance requires data users to comply with the six internationally recognized data protection principles in the processing and use of personal data.

Principle 1 relates to the purpose and manner of collection of personal data. Personal data must be collected for a lawful purpose and by fair means. The purpose of collection must be directly related to a function or activity of the data user. The data collected should be adequate but not excessive in relation to that purpose.

Principle 2 relates to the accuracy and duration of retention of personal data. Data users must ensure that the data held are accurate and up-to-date. They should not keep the data any longer than is necessary for its purpose.

Principle 3 relates to the use of personal data. Unless with the consent of the data subject, otherwise personal data should only be used for the purpose stated at the time of the collection or for a directly related purpose.

Principle 4 relates to the security of personal data, where a data user must take appropriate safeguards for the protection of personal data.

Principle 5 relates to the information to be generally available. A data user must make known the kind of personal data held by him and his policies and practices in relation to personal data.

Principle 6 relates to the access to personal data. An individual is entitled to make data access and data correction requests in respect of his personal data. For further details, please refer to the tape on "How to Exercise Your Data Access Right".

In case of any query on the six Data Protection Principles of the Ordinance, please call the PCPD Hotline on 2827 2827.

Date of amendment: 1st April 2013