PCPD - Getting to know the Personal Data (Privacy) Ordinance

Information Centre

speeches and Articles

Date: March, 1997

"Getting to know the Personal Data (Privacy) Ordinance"

by Robin McLeish, Deputy Privacy Commissioner for Personal Data

Introduction

The Personal Data (Privacy) Ordinance came into force on 20 December 1996. At the core of the Ordinance are six data protection principles. These principles encompass a set of fair information practices that have achieved international acceptance and are found in one form or another in personal data privacy laws around the world. This article gives an introduction to the data protection principles and what they mean for private sector organisations in general and journalists in particular.

The Data Protection Principles

The central pillar of the fair information practices embodied in the data protection principles is the notion that when individuals provide information about themselves they do so for particular purposes which should be adhered to. Accordingly, the data protection principles require that personal information should only be used for the purposes for which it was collected or ones directly related to them. To assist in giving effect to this requirement, the principles also require that individuals should be informed of the purposes for collecting their personal information when it is collected directly from them and that personal information should be kept for no longer than is necessary to fulfil those purposes.

In addition, the data protection principles require that personal information should be collected by means that are lawful and fair, its accuracy should be ensured and it should be held and transmitted under appropriate conditions of security. Lastly, they give individuals the right to access and correct personal information relating to themselves.

The Key Message

The key message to be drawn from the data protection principles is that persons who collect, use, hold and process personal information need to develop a special sensitivity towards such information. Personal information must not be treated as being simply a commercial commodity or just a tool of your trade. Individuals have privacy interests in their personal information and those interests must be respected and protected.

Concerns about the Impact of the Ordinance

Very few people would deny that the requirements of the data protection principles represent basic common-sense notions of fairness. Nevertheless, there are concerns about the impact of implementing them. In the private sector, such concerns revolve around the costs of implementation and restrictions on the ability of companies to maximise the value of their information resources.

Journalists, on the other hand, are concerned that the privacy argument will be used to restrict the free flow of information. They may also be concerned that the use of access rights and the powers of the Privacy Commissioner for Personal Data, the regulatory authority established by the Ordinance, may be used to interfere with their activities.

Private Sector Concerns

It is certainly true that implementation of the data protection principles requires changes to be made. Changes always have a price tag. There is the cost of revamping current systems: for example, to include statements of the purpose of collecting personal information in customer forms and to ensure the erasure of personal information when the original purposes of collection have been fulfilled. There is also the cost of devoting human resources to co-ordinating and drawing up procedures for compliance with the Ordinance. But the price of compliance must be viewed against the benefits.

Successful implementation of the data protection principles sends a positive message to customers and employees. It says we are about you as invididuals. This is good for customer and employee relations.

Implementation of the data protection principles is also an opportunity to get to grips with information collection, holding and processing systems that may no longer be fully under control. Are you sure that you are doing your best to collect only the information you need and to ensure accuracy? Improvements in these areas should bring operational efficiency and planning gains.

At a higher level, comfort should be taken from the fact that the implementation of the Personal Data (Privacy) Ordinance means that Hong Kong comes up to the international standard that other places with such laws wish to see. As a result, there should be no interference by those other places in the free flow of personal information to Hong Kong on which trade, particularly in the service industries, crucially depends.

[Image of Next Page]

[Image of Archive]

End of Page

[Press Releases] [Speeches, Articles & Papers] [Announcement of Public Interest] [Exhibition Materials] [Other Related Websites] [Archive] [Other Resources] [On-line Self Training] [Submissions to Public Consultation] [Privacy Commissioner's response following former Deputy Commissioner's conviction] [Response to the loss of medical data by Department of Health] [Privacy Commissioner commits himself to securing patients' data] [Privacy Commissioner commences inspection against Hospital Authority] [Response to data leakage by Immigration Department] [Response to data loss by HSBC] [Privacy is Your Business International Privacy Video Competition] [Privacy Commissioner strives to promote protection of personal data privacy] [Response following former Deputy Commissioner's conviction] [The Privacy Commissioner's clarification on criminalizing data leakage] [The Privacy Commissioner responds to media report today that] [Response to data leakage by the Police] [Progress of Inspection Against Hospital Authority] [The Director of Immigration Department signed formal undertaking] [Speech by Privacy Commissioner at the special meeting of Legislative Council Panel on Home Affairs] [Response to data loss incidents by The Hongkong and Shanghai Banking Corporation Limited] [The Privacy Commissioner completes the Inspection of the Hospital Authority's Personal Data System] [Privacy Commissioner Publishes Inspection Report on Hospital Authority] [Privacy Commissioner explains recommendations on the protection of patients' data privacy] [Privacy Commissioner accepts an Undertaking by HSBC] [Privacy is Your Business International Privacy Video Competition Prize Presentation Ceremony] [Response to Judgment of judicial review application by Cathay Pacific] [Privacy Commissioner welcomes HA's effort to enhance patient data privacy] [Statement by the Privacy Commissioner Following the Judgment made in HCAL 50/2008] [PCPD received a letter from CX Flight Attendants Union] [Impact of Technology on Data Privacy]

[About PCPD] [The Ordinance] [PCPD Activities] [Information Centre] [Privacy Zone for Youngsters (Games)]
[Publications & Videos] [Enquiries & Complaints] [Case Notes] [Contact Us] [Search] [Site Directory] [Graphical Version]
[Chinese Version]