The following can only be a brief introduction of the legal subject concerned. Before you take any action which may have legal consequence, you should first seek advice from your own lawyer or make an appointment at any District Office to see a volunteer lawyer of the Free Legal Advice Scheme.




(822) HOW TO EXERCISE YOUR DATA ACCESS RIGHT

Voice

Under the Personal Data (Privacy) Ordinance, you have the right to request another party, for example, a government department or an organisation, to confirm whether it holds any of your personal data and to request a copy of any such data. You also have the right to request it to correct any inaccurate data about you.

When making the data access request, you should use the "Personal Data (Privacy) Ordinance Data Access Request Form" specified by the Office of the Privacy Commissioner for Personal Data (the "OPS003 Form") or simply specify that his/her request is made under the Ordinance. You should specify clearly in the form the information required so that the party concerned could process your request with minimum delay. If you do not use this Form, the party concerned may refuse to comply with your data access request.

Also, the party concerned may ask you to show proof of your identity such as your identity card or other identifying documents such as a staff card, medical card or student card. You may also be asked to provide further information to enable the location of the data you requested. In some cases, you may need to fill in other forms specified by the party concerned although it is not mandatory to do so.

Generally speaking, the party concerned is required to comply with your data access request no later than 40 days after receipt of your request and should provide you with a copy of the data requested. If the party is unable to comply with your request within 40 days, it should comply with it as soon as practical thereafter. Even if the party concerned is unable to comply with your request within such a period or has valid grounds to refuse your request, it should reply to you within 40 days setting out the reasons for the refusal or its inability to comply with your request.

Please note that under the Ordinance, a fee can be charged by the party concerned for complying with a data access request. However, the fee must not be "excessive". That is, the party concerned is only allowed to charge you for the costs which are "directly related to and necessary for" complying with your request. It should not charge a fee on a commercial basis more than the direct cost of complying with your request. If you believe that the fee charged for your access request is excessive, you should raise the matter with the party concerned. If you are not satisfied with its explanation, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data ("the PCPD").

Furthermore, if the data provided in response to your request are incorrect, you can make a data correction request. Similar to data access request, the party concerned, on receipt of your data correction request, should respond within 40 days of the request. If your data correction request is complied with, the party concerned should provide you with a copy of the corrected data. If not, the party should inform you why your correction request is not complied with.

In case you have any query on the data access request, please call the PCPD Hotline on 2827 2827.

Date of amendment: 1st April 2013