5. Complaint Case Notes from the PCPD – System loopholes mended to prevent unauthorized or accidental access to password protected personal data files of customers.
Please read the case details provided by the PCPD website.
Last revision date:
5. Complaint Case Notes from the PCPD – System loopholes mended to prevent unauthorized or accidental access to password protected personal data files of customers.
Choosing a subtopic
-
The meaning of "personal data" and the six data protection principles
- 1. What are the consequences of beaching the data protection principles?
- 2. Are there any situations in which the persons/companies holding personal data may be exempt from the Ordinance or the Data Protection Principles?
- 3. Do the Data Protection Principles apply to the outsourced processing of personal data?
- 4. While browsing the Internet, I discover that my photo has been posted on a local website without my consent. That photo, I believe, was secretly taken by someone while I was window-shopping in an arcade one week ago. Can I sue the relevant webmaster or the photographer under the Personal Data (Privacy) Ordinance?
- 5. What are the functions of the Privacy Commissioner's Office (PCPD)?
-
Consumer credit data (relating to records of any loan or credit provided by banks or financial institutions)
- 1. What information would be written on a credit report? How can I contact the credit reference agency ("CRA") to obtain my own credit report?
- 2. What can I do if I find out that the information contained in my credit report is not accurate?
- 3. Can credit providers obtain a credit report about me at anytime they want?
- 4. Is there any information (about a borrower/debtor) that a credit provider must not report to a CRA?
- 5. If I act as a guarantor for my friend's loan from a bank, will the bank disclose my role as a guarantor to a CRA? Does the Code also cover the scenario of an individual being the guarantor for a corporate loan?
- 6. Is it compulsory for credit providers to provide all of an individual's (borrower or guarantor) loan account information to a CRA?
- 7. How long can a CRA retain my credit data? If I settle my loan account, will my credit data held by a CRA be deleted from its database?
- 8. Is there any benefit to keeping my closed account data in the CRA's database?
- 9. If I had a tax loan with a bank that I fully repaid before the effective date of the Code, and I have had a credit card with the same bank for many years. Can my bank provide data concerning these accounts to the CRA after the Code has taken effect?
- 10. If I declare bankruptcy, will my credit data held by a CRA be deleted from its database? What if I do not declare bankruptcy but have entered into an Individual Voluntary Arrangement (IVA, a debt repayment scheme recognized by the court) with my creditors?
- 11. Are there any safeguards to protect my credit data against improper access by credit providers?
- 12. What can I do if I find out that a credit provider or a CRA is not handling my data properly?
- 13. Enquiry Case Notes from the PCO – Should the bank notify me (as the guarantor of a loan facility) if my credit report is accessed when (i) the loan facility is applied for; and (ii) when the existing loan facility is reviewed?
- 14. By request of a law firm which acts for the administrator of a deceased person, if a bank discloses records of the deceased also contain information of third parties, is such disclosure a contravention of the Ordinance?
-
Use of ID card numbers and ID card copies
- 1. Generally speaking, under what circumstances can a person ask me to provide my ID card number or ID card copy?
- 2. Can the security staff of a building ask me to enter my ID card number in a visitors' log book at the entrance of a building?
- 3. Can a police officer ask me to show him/her my ID card?
- 4. Can a prospective employer record my ID card number or collect a copy of my ID card when I attend a job interview?
- 5. If I have accepted an employment offer, can my employer collect a copy of my ID card?
- 6. Can a club ask me to provide my ID card number and a copy of my ID card if I apply to be a member?
- 7. Can companies providing mobile phone services record my ID card number or collect a copy of my ID card if I apply for their services?
- 8. Can banks/insurance companies collect a copy of my ID card when I apply to be their customer?
- 9. What should I be aware of before I provide my ID card number or ID card copy to other persons?
- 10. Under what circumstances can a person ask me to provide other personal identifiers (e.g. staff number, passport number or patient number)?
- 11. Complaint Case Notes from the PCPD – A property management company collected identity card numbers of residents who were applying for electronic entrance cards gaining access to the building. Is this viewed as an excessive collection of personal data?
- 12. Complaint Case Notes from the PCPD – A person requested a refund of a tour fee and charges from a travel service agent. In processing the request, the travel agent required him to provide a photocopy of his Hong Kong identity card. Is this viewed as an excessive collection of personal data?
-
Privacy in Recruitment, human resources management and at work
-
Recruitment
- 1. What is a "blind" recruitment advertisement? Does the Code of Practice on Human Resource Management apply to all recruitment advertisements?
- 2. Why is an employer required to identify itself in recruitment advertisements that solicit personal data from job applicants?
- 3. Can an employer directly solicit personal data from job applicants if it merely uses its company email address, telephone number or fax number as a means of identifying itself in a recruitment advertisement?
- 4. Some employers only provide their fax numbers, postal addresses or e-mail addresses in recruitment advertisements without explicitly asking job applicants to submit their personal data. Is this practice acceptable under the Code?
- 5. Should an employer provide, within a recruitment advertisement, a statement regarding the purpose for which the personal data submitted by job applicants will be used?
- 6. Can an employer ask job applicants whether they have any criminal record?
- 7. On a company's job application form, there is a column requesting personal data concerning the applicant's spouse/children's occupations. The purpose of this is to ascertain whether the relatives work for one of its competitors. Is this acceptable?
- 8. Can an employer collect copies of the identity cards of job applicants? How long is an employer allowed to keep the personal data of unsuccessful job applicants?
-
Human Resources Management
- 9. Are there any situations in which employers holding personal data may be exempt from the Ordinance or the data protection principles?
- 10. How long is an employer allowed to keep the personal data of former employees?
- 11. An employer wants to announce the resignation of a former employee in a newspaper. What should the employer be aware of?
- 12. Do employees have the right to obtain a copy of their personal records including appraisal reports?
- 13. Who is liable for a contravention of the Ordinance in relation to employment-related personal data – the employer or the human resources manager?
- 14. Complaint Case Notes from the PCPD – Can employment agents, for the purpose of guaranteeing their commission payments, collect ID card copies from job applicants?
- 15. Complaint Case Notes from the PCPD – Is the posting of an employee's complaint letter on a notice board an intrusion of personal data privacy?
-
Privacy at work
- 16. What are the things that employers should consider before conducting work monitoring measures (e.g. telephone, video, e-mail or internet monitoring)? Can covert/secret monitoring of employees be adopted?
- 17. Should employers notify their employees before commencing the above-mentioned work monitoring measures? How should employers manage the data collected?
- 18. Can I install a video camera at home to monitor my domestic helper?
-
Recruitment
-
Privacy on the Internet
- 1. Have you checked your Internet Service Provider (ISP)'s policies on using "clicktrails" (your webpage browsing record)?
- 2. Are you asked to provide your personal data on-line?
- 3. Have you set your Internet browser to ask you before accepting a "cookie"?
- 4. Are you annoyed about direct marketing e-mails addressed to you?
- 5. Complaint Case Notes from the PCPD – System loopholes mended to prevent unauthorized or accidental access to password protected personal data files of customers.
-
Privacy regarding direct marketing
- A. Use of personal data for the data user’s own direct marketing purposes
- B. Provision of personal data to third parties for use in direct marketing
- 1. Regardless of the property owner's objections, if an estate agent repeatedly call the owner to persuade him/her to sell the property, will this violate section 35G of the Ordinance?
- 2. Is it an appropriate use of personal data in political direct marketing if a councillor's office uses the contact information from citizens who have sought assistance from the office to make election publicity calls?
- Complaints, penalties and legal assistance
Print
EmailCopyright © 2004 - 2023 Community Legal Information Centre (CLIC), The University of Hong Kong. All Rights Reserved.
Web Design By Visible One