Information Centre
archive_1
| Date: September 17 - 19, 1997 |
|
The Asian Status with respect to the observance of the OECD Guidelines and the EU Directive by Stephen Lau, Privacy Commissioner for Personal Data
Hong Kong Introduction The Organisation for Economic Co-operation and Development (OECD), membership of which include many European countries and USA, Australia, New Zealand and Japan, is primarily concerned with the economic development of its member states. In an effort to reconcile fundamental but competing values such as privacy and the free flow of information, OECD recommended in September 1980 to member countries to take into account in their domestic regulation, the principles concerning the protection of privacy and individual liberties set forth in a set of guidelines governing the protection of privacy and transborder flow of personal data. Within these guidelines are eight basic principles in the protection of information privacy. These principles, and variations thereof, have been the universal basis for the formulation of national legislation in privacy and personal data protection in many countries. Asian Situation With the increasing tempo of global trade and service activities in Asia with the rest of the world coupled with the recognition and expectations of increasingly affluent Asian communities for the respects of human rights including privacy, the issue of information privacy is receiving significant attention by Asian governments. As of today, there are three jurisdictions in Asia which have generic law for the protection of personal data. They are: Japan: The Act for Protection of Computer Processed Personal Data held by Administrative Organs (enacted December 1988) Key Aspects: it only covers the federal agencies, and only computer processing systems with personal data Taiwan: Law Governing Protection of Personal Data Processed by Computers (enacted July 1995) Key Aspects: it covers both the public and private sectors, but only computer processing systems with personal data Hong Kong: The Personal Data (Privacy) Ordinance (enacted September 1995) Key Aspects: it covers both the public and private sectors, and the processing of both automated and manual data. It also creates an independent supervisory body with significant enforcement powers. The provisions of these three laws are reviewed in terms of conformance to the OECD principles. OECD Collection Limitation Principle There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject. Hong Kong: Data Protection Principle 1 states that personal data shall be collected by means which are lawful and fair in the circumstances of the case, and that the data subject is explicitly or implicitly informed, on or before collecting the data, of whether it is obligatory or voluntary for him to supply the data, and the data collected are adequate but not excessive in relation to the purpose of collection. Observation: General conformance. Taiwan: Article 6 requires that "The collection or utilisation of personal data shall respect the rights and interests of the principal and such personal data shall be handled in accordance with the principles of honesty and credibility so as not to exceed the scope of the specific purpose". Observation: Limit to collection of data is explicit. Lawful collection is implied in "respecting the rights" of the data subject, and fairness is implied in "the principles of honesty and credibility". General conformance. Japan: Article 4 (1) requires the data user "in holding a personal data file shall confine itself to the extent necessary to perform the competent function provided by law", where "holding" is explicitly defined as "compiling or obtaining and maintaining". Observation: Article 4 embodies the essence of collection limitation, though there is no explicit statement regarding the lawful and fair means of data collection. OECD Data Quality Principle Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date. Hong Kong: Data Protection Principle 2 requires that all practical steps shall be taken to ensure that personal data are accurate and personal data shall not be kept longer than is necessary for the fulfilment of the purpose. "Inaccurate data" are defined in the law as data which are "incorrect, misleading, incomplete or obsolete". Observation: The requirement for accuracy is conformed and the relevancy of personal data with regard to the specified purpose is conformed through requirements of deletion, when appropriate, and the limits in data collection. Taiwan: The law requires a data user to "maintain the accuracy of personal data" (Article 13) and when the specific purpose for use no longer exists, a data user shall delete the data. Observation: General conformance though there is no definition of "accuracy". Japan: Article 4(2) requires "data recorded in personal data files shall not exceed the limit necessary for accomplishing the purpose of holding the personal data file". Article 5(2) requires the data user to "strive to ensure that the processed data should correspond with past and present facts". Observation: The relevancy of personal data is implicitly conformed through Article 4(2), and accuracy implicitly conformed through Article 5(2). OECD Purpose Specification Principle The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfilment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose. Hong Kong: Data Protection Principle 1 states that the data subject is explicitly informed, on or before collecting the data, of the purpose for which the data are to be used. Observation: General conformance. In addition, on or before data collection, the data subject is explicitly informed of the class of persons to whom the data may be transferred and of his rights to request access to and to request the correction of the data. Taiwan: Data shall not be collected by a data user unless "it has some specific purpose" (Articles 6 and 18). Observation: That there is a purpose at the time of collection is implied. The law goes further to specify the purpose criteria within which the data user can collect and process data, e.g. "it is within the scope of job functions provided by law and regulations", "there is no possibility that it shall infringe upon the rights and interests of the individual" etc. Japan: Article 4(1) requires the data user "in holding a personal data file, shall specify the purpose of such holding as much as possible". Observation: As "holding" includes "compiling and obtaining", the purpose of collection is implicitly specified at or before the time of collection. OECD Use Limitation Principle Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with the Purpose Specification Principle except : (a) with the consent of the data subject; or (b) by the authority of law. Hong Kong: Data Protection Principle 3 requires prescribed consent from the data subject before personal data can be used for a different purpose from the one specified at the time of collection. There are exemptions to this principle, as defined in the Ordinance which takes into account the authority of law. Observation: Prescribed consent is required and there are specific conditions for change of use without consent from the data subject, e.g. national defence, prevention of crime, taxation assessment, health, etc. Taiwan: A data user "shall utilise personal data within the scope of the specific purposes", and it may also utilise these data for other purposes with "written consent" of the data subject, "provided for in the laws and regulations", and other conditions without the consent of the data subject, including "safeguarding national security", "improve pubic interests", "preventing the rights and interests of another from being seriously damaged", "benefit the rights and interests" of the data subject, etc. Observation: Prescribed (written) consent is required; and there are broad and general conditions for change of use without the data subjects' consent. Japan: Article 9(1) states that "data shall not be used or provided for any purpose other than the file holding purpose". Exceptions to this provision include "when there is a consent of the data subject", and when permitted by law. Observation: General conformance. OECD Security Safeguards Principle Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data. Hong Kong: Data Protection Principle 4 requires all practical steps shall be taken to ensure personal data held by a data user are protected against unauthorised access, processing, erasure or other uses, with particular regard to physical location, data sensitivity, automatic systems security, data integrity and people competence and data transmission. Observation: General conformance. Taiwan: Article 17 requires the data user to "appoint a full time employee to handle matters relevant to the security and maintenance of said files to prevent personal data from being stolen, altered without authorisation, damaged, lost or disclosed". Observation: General conformance. Japan: Article 5(1) requires the data user and its current and former staff engaged in data processing to "strive to take measures necessary for prevention of leakage, loss, destruction of personal data or other proper managements". Observation: General conformance. |
End of Page
[Press Releases] [Speeches, Articles & Papers] [Announcement of Public Interest] [Exhibition Materials] [Other Related Websites] [Archive] [Other Resources] [On-line Self Training] [Submissions to Public Consultation] [Privacy Commissioner's response following former Deputy Commissioner's conviction] [Response to the loss of medical data by Department of Health] [Privacy Commissioner commits himself to securing patients' data] [Privacy Commissioner commences inspection against Hospital Authority] [Response to data leakage by Immigration Department] [Response to data loss by HSBC] [Privacy is Your Business International Privacy Video Competition] [Privacy Commissioner strives to promote protection of personal data privacy] [Response following former Deputy Commissioner's conviction] [The Privacy Commissioner's clarification on criminalizing data leakage] [The Privacy Commissioner responds to media report today that] [Response to data leakage by the Police] [Progress of Inspection Against Hospital Authority] [The Director of Immigration Department signed formal undertaking] [Speech by Privacy Commissioner at the special meeting of Legislative Council Panel on Home Affairs] [Response to data loss incidents by The Hongkong and Shanghai Banking Corporation Limited] [The Privacy Commissioner completes the Inspection of the Hospital Authority's Personal Data System] [Privacy Commissioner Publishes Inspection Report on Hospital Authority] [Privacy Commissioner explains recommendations on the protection of patients' data privacy] [Privacy Commissioner accepts an Undertaking by HSBC] [Privacy is Your Business International Privacy Video Competition Prize Presentation Ceremony] [Response to Judgment of judicial review application by Cathay Pacific] [Privacy Commissioner welcomes HA's effort to enhance patient data privacy] [Statement by the Privacy Commissioner Following the Judgment made in HCAL 50/2008] [PCPD received a letter from CX Flight Attendants Union] [Impact of Technology on Data Privacy]
[About PCPD] [The
Ordinance] [PCPD Activities]
[Information Centre] [Privacy
Zone for Youngsters (Games)]
[Publications & Videos]
[Enquiries & Complaints]
[Case Notes] [Contact
Us] [Search] [Site
Directory] [Graphical Version]
[Chinese Version]
Notice/Copyright 2001 Office of the Privacy Commissioner for Personal Data, Hong Kong. All rights reserved. Disclaimer