receives a complaint; or

has reasonable grounds to believe that an act or practice-

1. has been done or engaged in, or is being done or engaged in, as the case may be, by a data user;
2. relates to personal data; and
3. may be a contravention of a requirement under this Ordinance, then-
   
   (i) where paragraph (a) is applicable, the Commissioner shall, subject to section 39, carry out an investigation in relation to the relevant data user to ascertain whether the act or practice specified in the complaint is a contravention of a requirement under this Ordinance;
   
   (ii) where paragraph (b) is applicable, the Commissioner may carry out an investigation in relation to the relevant data user to ascertain whether the act or practice referred to in that paragraph is a contravention of a requirement under this Ordinance.