***************************************
Following is a question by the Hon James To and a reply by the Secretary for Home Affairs, Dr Patrick Ho, in the Legislative Council today (April 26):
Question:
According to the Personal Data (Privacy) Ordinance, where, after investigation, the Privacy Commissioner for Personal Data (the Commissioner) is of the opinion that a data user has contravened a requirement or a data protection principle of the Ordinance, he may issue an enforcement notice to him to remedy the contravention. The data user will commit an offence only if he contravenes the enforcement notice. In this connection, will the Government inform this Council whether:
(a) it will conduct a comprehensive review on the Ordinance, and consider empowering the Commissioner to institute prosecutions directly against those who have seriously contravened data protection principles; and
(b) it will allocate additional resources to the Commissioner for deploying additional manpower to initiate investigation into cases in which he suspects that the Ordinance has been contravened?
Reply:
Madam President,
(a) Since the Personal Data (Privacy) Ordinance (the Ordinance) came into effect in 1996, we have liaised closely with the Privacy Commissioner for Personal Data (the Commissioner) to review how to improve the Ordinance in order to resolve the problems encountered in the course of implementation. The Commissioner is now reviewing whether contravention of data protection principles should be made an offence. When the Commissioner submits his detailed recommendations to the Home Affairs Bureau upon completion of the review, we shall examine the feasibility of the proposals. In examining the recommendations, we shall take into account how contravention of data protection principles is dealt with under privacy legislation in other jurisdictions, the seriousness of such contravention, whether there is an upward trend in contravention of data protection principles, etc.
(b) The Commissioner has established a well-tested and cost-effective system to follow up cases of possible contravention of the Ordinance before deciding whether to conduct further investigations. The Commissioner comes to know of cases of possible contravention of the Ordinance by data users through various channels, such as media reports, complaints and reports by the public. Depending on the seriousness of a case, he may initiate self-initiated investigations immediately, or conduct a compliance check before deciding whether to carry out formal investigations.
In 2004 and 2005, the Commissioner handled 1,085 and 1,140 complaints, conducted 63 and 139 compliance checks, and carried out formal investigations into 39 and 24 cases respectively.
If the Commissioner requires additional manpower to step up law enforcement, he may submit an application to the Government in accordance with the procedures of the Resource Allocation Exercise.
Ends/Wednesday, April 26, 2006
Issued at HKT 12:31
NNNN