Response to media enquiries about the operation of a hotline to receive reports on class boycotts in secondary schools

10 September 2014

Response to media enquiries about the operation of a hotline to receive reports on class boycotts in secondary schools

(10 September 2014) In response to the mounting public concern about the setting up of a hotline “Help Our Children” to collect information about student participation in class boycotts, the Office of the Privacy Commissioner for Personal Data (“PCPD”) has issued a letter to the hotline organiser, the Alliance for Peace and Democracy (“Alliance”) reminding them that the requirements of the 6 Data Protection Principles (“DPPs”) in the Personal Data (Privacy) Ordinance (“Ordinance”) must be complied with.

Based on the information made public by the Alliance and other information gathered by PCPD so far, PCPD has the following preliminary observations:-

Data Protection Principle 1

This principle requires the data user to collect only the personal data for a purpose directly related to its function or activity; collect data as necessary and not excessively; and collect data by means which are lawful and fair.

Any person or organisation may collect personal data in accordance with the above requirements. PCPD notes that the Alliance has set up hotlines to collect information in relation to its self-defined activities. At the moment, there is no evidence to suggest that the Alliance has applied unlawful or misleading means to request other persons or organisations to provide the personal data of students in relation to class boycotts or that it will collect excessive personal data.

Data Protection Principle 2

This principle requires that all practicable steps shall be taken by the data user to ensure the accuracy of the personal data under its control, and such data shall be destroyed upon fulfillment of the purpose for which the data is used.

The extent of accuracy required by this principle is relative to the usage of the data concerned. It does not require the data user to ensure that the data held is absolutely correct. Given that the Alliance has indicated it will review the information received by cross-validation from two independent information sources before providing the reported class boycotts information to the relevant schools etc., there is no prima facie contravention of the requirements of this principle despite the Alliance’s inability to verify beyond all doubt the validity of the reported information.

Regarding the retention of data, the principle will be complied with so long as the Alliance will delete the personal data collected upon fulfillment of the purpose for which the data is used.

Data Protection Principle 3

This principle stipulates that unless the data subject has given prior consent, personal data shall only be used for the purpose for which it was originally collected or a directly related purpose.

The Alliance has declared that it would only disclose the names of the schools with class boycotts to the schools concerned and other related organisations. Where no personal data of the students (e.g. names of the students, their attending classes or faculties) is disclosed, this principle will not have any application.

On the other hand, the informant who provides personal data to the hotline has the obligation to comply with the requirements of this principle.

Data Protection Principle 4

This principle requires the data user to take all practicable steps to ensure the security of personal data and protect it against unauthorised or accidental access, processing, erasure, loss or use. There is at present no evidence indicating that the Alliance has failed to put in place appropriate measures to comply with this requirement.

Data Protection Principle 6

This principle provides the right for a data subject to request the Alliance to advise if it holds his personal data; and if yes, to request for a copy of such data and for correction of inaccurate data. If the data subject makes such a request, the Alliance has to comply not later than 40 days after receiving the same unless the reasons justifying non-compliance as stipulated in the Ordinance apply.

By the close of play today, PCPD has received a total of 70 public enquiries and complaints concerning the operation of the hotline. These cases are being actively pursued. It is noted that most if not all of the complaints received are not made by individuals who are the subjects of the personal data concerned and no concrete information has been provided to suggest that the operation of the hotline may contravene the requirements under the Ordinance. Hence PCPD foresees difficulties in taking effective enforcement action. Nevertheless, PCPD will continue to closely monitor the situation, and take follow up action as appropriate in light of further developments.