|
Legal
Notes
on Appeal Cases lodged with the Administrative Appeals Board
Under the PD(P)O, where
the Privacy Commissioner has decided to exercise his power under section
39 to refuse to investigate or to continue to investigate a complaint
brought before him, the complainant may appeal to the Administrative Appeals
Board ("AAB") against such decision. Furthermore, where the
Privacy Commissioner has completed an investigation, his decision not
to issue an enforcement notice against the data user complained against
may be the subject of an appeal to the AAB by the complainant. Alternatively,
if as a result of an investigation, the Privacy Commissioner decides to
issue an enforcement notice against the data user investigated, the data
user may also appeal to the AAB against the enforcement notice so issued.
There were in total
16 AAB appeal cases disposed of in the reporting period. Out of which,
7 cases were dismissed, 7 cases were struck out, 1 case was withdrawn
and for the remaining one, the terms of the enforcement notice issued
were varied. Case notes on some of the appeal cases are given below.
| Appeal
against the issuance of an enforcement notice (1/03) |
This was an appeal by
a University against an enforcement notice issued by the Privacy Commissioner
pursuant to section 50 of the PD(P)O. The complainant was a staff member
of the University. She made two data access requests to the University.
The first request was for access to her personal data from the Personnel
Office and a Department of the University. In the second request, she
sought access to all data including data that came to the possession of
the University since her first request. In responding to her requests,
the University provided 550 pages of documents to the complainant. Not
satisfied with what she obtained, the complainant lodged a complaint with
the PCPD alleging that the University had not provided her with all her
personal data as requested in her data access requests.
The PCPD carried out
an investigation of the complaint and conducted a site investigation at
the premises of the University. Having completed the investigation, the
Privacy Commissioner found that the University failed to provide a copy
of certain documents which, being personal data of the complainant, should
have been given to the complainant in accordance with section 19(1) of
the PD(P)O. To remedy the contravention, the Privacy Commissioner served
an enforcement notice on the University directing it, amongst others,
to:
| a) |
conduct a thorough
search amongst the complainant's personal data that were in possession
and control by the University; and |
| |
|
| b) |
compile and provide
to the complainant a Consolidated Document List. |
The University appealed
to the AAB. The AAB decided that by imposing the requirement of conducting
a "thorough search", the Privacy Commissioner in effect placed
a higher burden on the data user than the statutory duty to exercise all
due diligence as required under section 64(8) of the PD(P)O. As regards
the "Consolidated Document List" the AAB held the view that
the complainant had no right to such a list and the imposition of this
requirement was contrary to section 20(3)(b) of the PD(P)O. It was for
the data requestor to identify the data he or she required and not for
the data user to prepare a full or consolidated list for the data requestor
to pick and choose. For these reasons, the AAB decided to strike out the
requirements of a "thorough search" and a "Consolidated
Document List" and adopted an amended enforcement notice to replace
the one issued by the Privacy Commissioner.
   
|
