Cap 486 - Personal Data (Privacy) Ordinance 1
Chapter: 486 Personal Data (Privacy) Ordinance Gazette Number Version Date
Long title E.R. 1 of 2013 25/04/2013
An Ordinance to protect the privacy of individuals in relation to personal data, and to provide for matters incidental
thereto or connected therewith.
(Enacted 1995)
[Part 2, section 71 (as affects
Schedule 2) and Schedule 2 } 1 August 1996 L.N. 343 of 1996
} 20 December 1996 L.N. 514 of 1996
} 1 August 1997 L.N. 409 of 1997]
The other provisions, excluding
sections 30 and 33
Section 30
(Enacting provision omitted—E.R. 1 of 2013)
(Originally 81 of 1995)
(*Format changes—E.R. 1 of 2013)
_______________________________________________________________________________
Note:
*The format of the Ordinance has been updated to the current legislative styles.
Part: 1 Preliminary E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 1 Short title and commencement E.R. 1 of 2013 25/04/2013
Remarks:
For the saving and transitional provisions relating to the amendments made by the Resolution of the Legislative
Council (L.N. 130 of 2007), see paragraph (12) of that Resolution.
(1) This Ordinance may be cited as the Personal Data (Privacy) Ordinance.
(2) This Ordinance shall come into operation on a day to be appointed by the Secretary for Constitutional and
Mainland Affairs by notice in the Gazette. (Amended L.N. 130 of 2007)
(Enacted 1995)
Section: 2 Interpretation E.R. 1 of 2013 25/04/2013
(1) In this Ordinance, unless the context otherwise requires-
act (作為) includes a deliberate omission;
adverse action (不利行動), in relation to an individual, means any action that may adversely affect the individual's
rights, benefits, privileges, obligations or interests (including legitimate expectations);
appointed day (指定日) means the day appointed under section 1(2);
approved code of practice (核准實務守則) means a code of practice approved under section 12;
change notice (變更通知) means a notice served on the Commissioner under section 14(8) and, if applicable,
corrected under section 14A(5); (Added 18 of 2012 s. 3)
code of practice (實務守則) includes-
(a) a standard;
(b) a specification; and
Cap 486 - Personal Data (Privacy) Ordinance 2
(c) any other documentary form of practical guidance;
Commissioner (專員) means the Privacy Commissioner for Personal Data established under section 5(1);
Committee (諮詢委員會) means the Personal Data (Privacy) Advisory Committee established under section 11(1);
complainant (投訴人) means the individual, or the relevant person on behalf of an individual, who has made a
complaint;
complaint (投訴) means a complaint under section 37;
correction (改正), in relation to personal data, means rectification, erasure or completion;
daily penalty (每日罰款) means a penalty for each day on which the offence is continued after conviction therefor;
data (資料) means any representation of information (including an expression of opinion) in any document, and
includes a personal identifier;
data access request (查閱資料要求) means a request under section 18;
data correction request (改正資料要求) means a request under section 22(1);
data protection principle (保障資料原則) means any of the data protection principles set out in Schedule 1;
data subject (資料當事人), in relation to personal data, means the individual who is the subject of the data;
data user (資料使用者), in relation to personal data, means a person who, either alone or jointly or in common with
other persons, controls the collection, holding, processing or use of the data;
data user return (資料使用者申報表) means a return submitted to the Commissioner under section 14(4) and, if
applicable, corrected under section 14A(5); (Replaced 18 of 2012 s. 3)
disclosing (披露), in relation to personal data, includes disclosing information inferred from the data;
document (文件) includes, in addition to a document in writing-
(a) a disc, tape or other device in which data other than visual images are embodied so as to be capable, with or
without the aid of some other equipment, of being reproduced from the disc, tape or other device; and
(b) a film, tape or other device in which visual images are embodied so as to be capable, with or without the aid
of some other equipment, of being reproduced from the film, tape or other device;
employment (僱用) means employment under-
(a) a contract of service or of apprenticeship; or
(b) a contract personally to execute any work or labour,
and related expressions shall be construed accordingly;
enforcement notice (執行通知) means a notice under section 50(1);
financial regulator (財經規管者) means any of-
(a) the Monetary Authority appointed under section 5A of the Exchange Fund Ordinance (Cap 66);
(b) the Securities and Futures Commission referred to in section 3(1) of the Securities and Futures Ordinance
(Cap 571); (Replaced 5 of 2002 s. 407)
(c) a recognized clearing house, a recognized exchange company, a recognized exchange controller or a
recognized investor compensation company within the meaning of section 1 of Part 1 of Schedule 1 to the
Securities and Futures Ordinance (Cap 571); (Replaced 5 of 2002 s. 407)
(d) a person authorized under Part III of the Securities and Futures Ordinance (Cap 571) to provide automated
trading services as defined in Schedule 5 to that Ordinance; (Replaced 5 of 2002 s. 407)
(e)-(ea) (Repealed 5 of 2002 s. 407)
(f) the Insurance Authority appointed under section 4 of the Insurance Companies Ordinance (Cap 41);
(g) the Registrar of Occupational Retirement Schemes appointed under section 5 of the Occupational
Retirement Schemes Ordinance (Cap 426);
(ga) the Mandatory Provident Fund Schemes Authority established by section 6 of the Mandatory Provident
Fund Schemes Ordinance (Cap 485); (Added 4 of 1998 s. 14)
(gb) the Financial Reporting Council established by section 6(1) of the Financial Reporting Council Ordinance
(Cap 588); (Added 18 of 2006 s. 84)
(h) a person specified in a notice under subsection (7) to be a regulator for the purposes of this definition;
inaccurate (不準確), in relation to personal data, means the data is incorrect, misleading, incomplete or obsolete;
inspection (視察) means an inspection under section 36;
investigation (調查) means an investigation under section 38;
Cap 486 - Personal Data (Privacy) Ordinance 3
log book (紀錄簿), in relation to a data user, means the log book kept and maintained by the data user under section
27(1);
matching procedure (核對程序) means any procedure whereby personal data collected for 1 or more purposes in
respect of 10 or more data subjects is compared (except by manual means) with personal data collected for any
other purpose in respect of those data subjects where the comparison- (Amended 18 of 2012 s. 3)
(a) is (whether in whole or in part) for the purpose of producing or verifying data that; or
(b) produces or verifies data in respect of which it is reasonable to believe that it is practicable that the data,
may be used (whether immediately or at any subsequent time) for the purpose of taking adverse action against
any of those data subjects;
matching procedure request (核對程序要求) means a request under section 31(1);
personal data (個人資料) means any data-
(a) relating directly or indirectly to a living individual;
(b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and
(c) in a form in which access to or processing of the data is practicable;
personal data system (個人資料系統) means any system, whether or not automated, which is used, whether in
whole or in part, by a data user for the collection, holding, processing or use of personal data, and includes any
document and equipment forming part of the system;
personal identifier (個人身分標識符) means an identifier-
(a) that is assigned to an individual by a data user for the purpose of the operations of the user; and
(b) that uniquely identifies that individual in relation to the data user,
but does not include an individual's name used to identify that individual;
practicable (切實可行) means reasonably practicable;
prescribed information (訂明資訊) means any information specified in Schedule 3; (Added 18 of 2012 s. 3)
prescribed officer (訂明人員) means a person employed or engaged under section 9(1);
processing (處理), in relation to personal data, includes amending, augmenting, deleting or rearranging the data,
whether by automated means or otherwise;
register (登記冊) means the register of data users kept and maintained by the Commissioner under section 15(1);
relevant data user (有關資料使用者), in relation to-
(a) an inspection, means the data user who uses the personal data system which is the subject of the inspection;
(b) a complaint, means the data user specified in the complaint;
(c) an investigation-
(i) in the case of an investigation initiated by a complaint, means the data user specified in the complaint;
(ii) in any other case, means the data user the subject of the investigation;
(d) an enforcement notice, means the data user on whom the notice is served;
relevant person (有關人士), in relation to an individual (howsoever the individual is described), means-
(a) where the individual is a minor, a person who has parental responsibility for the minor;
(b) where the individual is incapable of managing his own affairs, a person who has been appointed by a court
to manage those affairs;
(c) where the individual is mentally incapacitated within the meaning of section 2 of the Mental Health
Ordinance (Cap 136)-
(i) a person appointed under section 44A, 59O or 59Q of that Ordinance to be the guardian of that
individual; or
(ii) if the guardianship of that individual is vested in, or the functions of the appointed guardian are to be
performed by, the Director of Social Welfare or any other person under section 44B(2A) or (2B) or
59T(1) or (2) of that Ordinance, the Director of Social Welfare or that other person; (Replaced 18 of
2012 s. 3)
requestor (提出要求者), in relation to-
(a) a data access request or data correction request, means the individual, or the relevant person on behalf of an
individual, who has made the request;
(b) a matching procedure request, means the data user who has made the request;
rule of law (法律規則) means-
Cap 486 - Personal Data (Privacy) Ordinance 4
(a) a rule of common law or a rule of equity; or
(b) customary law; (Added 18 of 2012 s. 3)
specified (指明), in relation to a form, means specified under section 67;
third party (第三者), in relation to personal data, means any person other than-
(a) the data subject;
(b) a relevant person in the case of the data subject;
(c) the data user; or
(d) a person authorized in writing by the data user to collect, hold, process or use the data-
(i) under the direct control of the data user; or
(ii) on behalf of the data user;
use (使用), in relation to personal data, includes disclose or transfer the data;
would be likely to prejudice (相當可能損害) includes would prejudice.
(2) (Repealed 18 of 2012 s. 3)
(3) Where under this Ordinance an act may be done with the prescribed consent of a person (and howsoever the
person is described), such consent-
(a) means the express consent of the person given voluntarily;
(b) does not include any consent which has been withdrawn by notice in writing served on the person to whom
the consent has been given (but without prejudice to so much of that act that has been done pursuant to the
consent at any time before the notice is so served).
(4) Subject to section 64, it is hereby declared that any reference in this Ordinance to the effect that a data user
(howsoever described)- (Amended 18 of 2012 s. 3)
(a) has contravened a requirement under this Ordinance; or
(b) is contravening a requirement under this Ordinance,
includes-
(i) where paragraph (a) is applicable, any case where the data user has done an act, or engaged in a practice, in
contravention of a data protection principle;
(ii) where paragraph (b) is applicable, any case where the data user is doing an act, or engaging in a practice, in
contravention of a data protection principle.
(5) Notwithstanding any other provisions of this Ordinance, a complaint may be made (and an investigation, if any,
initiated by the complaint may be carried out) in relation to a person who has ceased to be a data user except any
such person who has not at any time been a data user during the period of 2 years immediately preceding the
date on which the Commissioner receives the complaint and, accordingly, a person in relation to whom such a
complaint is made shall for the purposes of such complaint (and an investigation, if any, initiated by such
complaint) be deemed to be a data user, and the other provisions of this Ordinance shall be construed
accordingly.
(6) Any reference in this Ordinance to a data protection principle followed by a number is a reference to the
principle bearing that number set out in Schedule 1.
(7) The Chief Executive may, by notice in the Gazette, specify a person to be a regulator for the purposes of the
definition of financial regulator. (Amended 34 of 1999 s. 3)
(8) It is hereby declared that a notice under subsection (7) is subsidiary legislation.
(9) Where a person-
(a) holds any office, engages in any profession or carries on any occupation; and
(b) is required by any law, or by any rules made under or by virtue of any law, to be a fit and proper person (or
words to the like effect) to hold that office, engage in that profession or carry on that occupation,
then, for the purposes of this Ordinance, any conduct by that person by virtue of which he ceases, or would
cease, to be such a fit and proper person shall be deemed to be seriously improper conduct.
(10) Subsection (9) shall not operate to prevent seriously improper conduct including, for the purposes of this
Ordinance, conduct by virtue of which a person ceases, or would cease, to be a fit and proper person
notwithstanding that the conduct is not conduct to which that subsection applies.
(11) Words and expressions importing the neuter gender in relation to any data user shall include the masculine and
feminine genders.
(12) A person is not a data user in relation to any personal data which the person holds, processes or uses solely on
behalf of another person if, but only if, that first-mentioned person does not hold, process or use, as the case may
be, the data for any of his own purposes. (Amended 18 of 2012 s. 2)
Cap 486 - Personal Data (Privacy) Ordinance 5
(13) For the avoidance of doubt, it is hereby declared that, for the purposes of this Ordinance, any conduct by a
person by virtue of which he has or could become a disqualified person or a suspended person under the Rules of
Racing and Instructions by the Stewards of the Hong Kong Jockey Club, as in force from time to time, is
seriously improper conduct. (Amended 34 of 1999 s. 3)
(Enacted 1995)
Section: 3 Application E.R. 1 of 2013 25/04/2013
(1) This Ordinance binds the Government.
(2) (*Not adopted as the laws of HKSAR)
(Enacted 1995)
_________________________________________________________________________________
Note:
* See Decision of the Standing Committee of the National People's Congress on Treatment of the Laws
Previously in Force in Hong Kong in accordance with Article 160 of the Basic Law of the Hong Kong
Special Administrative Region of the People's Republic of China. (Instrument A206 in this database).
Section: 4 Data protection principles E.R. 1 of 2013 25/04/2013
A data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or
practice, as the case may be, is required or permitted under this Ordinance.
(Enacted 1995)
Part: 2 Administration E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 5 Establishment, etc. of Privacy Commissioner for Personal
Data
E.R. 1 of 2013 25/04/2013
(1) For the purposes of this Ordinance, there is hereby established an office by the name of the Privacy
Commissioner for Personal Data.
(2) The Commissioner shall be a corporation sole with perpetual succession and-
(a) shall have and may use a seal; and
(b) shall be capable of suing and being sued.
(3) The Chief Executive shall, by notice in the Gazette, appoint a person to be the Commissioner. (Amended 34 of
1999 s. 3)
(4) Subject to subsection (5), the person appointed to be the Commissioner shall hold office for a period of 5 years
and shall be eligible for reappointment for not more than 1 further period of 5 years.
(5) The person appointed to be the Commissioner may-
(a) at any time resign from his office by notice in writing to the Chief Executive; or
(b) be removed from office by the Chief Executive with the approval by resolution of the Legislative Council
on the ground of-
(i) inability to perform the functions of his office; or
(ii) misbehaviour. (Amended 34 of 1999 s. 3)
(6) The Chief Executive shall determine- (Amended 34 of 1999 s. 3)
(a) the emoluments; and
(b) the terms and conditions of appointment,
of the person appointed to be the Commissioner.
(7) The provisions of Schedule 2 shall have effect with respect to the Commissioner.
(8) Subject to subsection (9), the Commissioner shall not be regarded as a servant or agent of the Government or as
enjoying any status, immunity or privilege of the Government.
(9) The person appointed to be the Commissioner shall be deemed to be a public servant-
(a) within the meaning of section 2 of the Prevention of Bribery Ordinance (Cap 201); and
(b) for the purposes of that Ordinance.
Cap 486 - Personal Data (Privacy) Ordinance 6
(Enacted 1995)
Section: 6 Commissioner to hold no other office E.R. 1 of 2013 25/04/2013
The person appointed to be the Commissioner shall not, without the specific approval of the Chief Executive-
(Amended 34 of 1999 s. 3)
(a) hold any office of profit other than his office as Commissioner; or
(b) engage in any occupation for reward outside the functions of his office.
(Enacted 1995)
Section: 7 Filling of temporary vacancy E.R. 1 of 2013 25/04/2013
(1) Where the person appointed to be the Commissioner-
(a) dies;
(b) resigns;
(c) is removed from office;
(d) is absent from Hong Kong; or
(e) is for any other reason unable to perform the functions of his office,
then the Chief Executive may, by notice in writing, appoint a person to act as the Commissioner until, as the
case requires- (Amended 34 of 1999 s. 3)
(i) a new Commissioner is appointed under section 5(3); or
(ii) the Commissioner resumes his office.
(2) A person appointed under subsection (1) to act as the Commissioner, whilst he is so appointed-
(a) shall perform the functions; and
(b) may exercise the powers,
of the Commissioner under this Ordinance.
(3) Section 6 shall apply to a person appointed under subsection (1) to act as the Commissioner as if that person
were the Commissioner.
(Enacted 1995)
Section: 8 Functions and powers of Commissioner E.R. 1 of 2013 25/04/2013
(1) The Commissioner shall-
(a) monitor and supervise compliance with the provisions of this Ordinance;
(b) promote and assist bodies representing data users to prepare, for the purposes of section 12, codes of
practice for guidance in complying with the provisions of this Ordinance, in particular the data protection
principles;
(c) promote awareness and understanding of, and compliance with, the provisions of this Ordinance, in
particular the data protection principles;
(d) examine any proposed legislation (including subsidiary legislation) that the Commissioner considers may
affect the privacy of individuals in relation to personal data and report the results of the examination to the
person proposing the legislation;
(e) carry out inspections, including inspections of any personal data systems used by data users which are
departments of the Government or statutory corporations;
(f) for the better performance of his other functions, undertake research into, and monitor developments in, the
processing of data and information technology in order to take account of any likely adverse effects such
developments may have on the privacy of individuals in relation to personal data; (Amended 18 of 2012 s.
4)
(g) liaise and co-operate with any person in any place outside Hong Kong-
(i) performing in that place any functions which, in the opinion of the Commissioner, are similar (whether
in whole or in part) to any of the Commissioner's functions under this Ordinance; and
(ii) in respect of matters of mutual interest concerning the privacy of individuals in relation to personal
data; and
(h) perform such other functions as are imposed on him under this Ordinance or any other enactment.
(2) The Commissioner may do all such things as are necessary for, or incidental or conducive to, the better
Cap 486 - Personal Data (Privacy) Ordinance 7
performance of his functions and in particular but without prejudice to the generality of the foregoing, may-
(a) acquire and hold property of any description if in the opinion of the Commissioner such property is
necessary for-
(i) the accommodation of the Commissioner or of any prescribed officer; or
(ii) the performance of any function which the Commissioner may perform,
and, subject to the terms and conditions upon which such property is held, dispose of it;
(b) enter into, carry out, assign or accept the assignment of, vary or rescind, any contract, agreement or other
obligation;
(c) undertake and execute any lawful trust which has as an object the furtherance of any function which the
Commissioner is required or is permitted by this Ordinance to perform or any other similar object;
(d) accept gifts and donations, whether subject to any trust or not;
(e) with the prior approval of the Chief Executive, become a member of or affiliate to any international body
concerned with (whether in whole or in part) the privacy of individuals in relation to personal data;
(Amended 34 of 1999 s. 3)
(ea) carry out promotional or educational activities or services; and (Added 18 of 2012 s. 4)
(f) exercise such other powers as are conferred on him under this Ordinance or any other enactment.
(2A) The Commissioner may impose reasonable charges for any promotional or educational activities or services
carried out, or any promotional or educational publications or materials made available, by the Commissioner in
the course of the performance of the Commissioner’s functions under this Ordinance. (Added 18 of 2012 s. 4)
(3) The Commissioner may make and execute any document in the performance of his functions or the exercise of
his powers or in connection with any matter reasonably incidental to or consequential upon the performance of
his functions or the exercise of his powers.
(4) Any document purporting to be executed under the seal of the Commissioner shall be admitted in evidence and
shall, in the absence of evidence to the contrary, be deemed to have been duly executed.
(5) The Commissioner may from time to time cause to be prepared and published by notice in the Gazette, for the
guidance of data users and data subjects, guidelines not inconsistent with this Ordinance, indicating the manner
in which he proposes to perform any of his functions, or exercise any of his powers, under this Ordinance.
(Amended 18 of 2012 s. 4)
(Enacted 1995)
Section: 9 Staff of Commissioner, etc. E.R. 1 of 2013 25/04/2013
(1) The Commissioner may-
(a) employ such persons (including technical and professional persons); and
(b) engage, other than by way of employment, such technical and professional persons,
as he thinks fit to assist him in the performance of his functions, and the exercise of his powers, under this
Ordinance.
(2) The Commissioner shall determine-
(a) the remuneration and terms and conditions of employment of any person, or any person belonging to a class
of persons, who may be employed under subsection (1)(a);
(b) the remuneration and terms and conditions of engagement of any person, or any person belonging to a class
of persons, who may be engaged under subsection (1)(b).
(3) The Commissioner may-
(a) grant, or make provision for the grant of, pensions, gratuities and retirement benefits to employees;
(b) provide other benefits for the welfare of employees and their dependants;
(c) authorize payments, whether or not legally due, to the personal representatives of a deceased employee or to
any person who was dependent on such employee at his death.
(4) The Commissioner may-
(a) establish, manage and control; or
(b) enter into an arrangement with any company or association for the establishment, management and control
by that company or association either alone or jointly with the Commissioner of,
any fund or scheme for the purpose of providing for the pensions, gratuities, benefits and payments referred to in
subsection (3).
(5) The Commissioner may make contributions to and may require employees to make contributions to any fund or
scheme referred to in subsection (4).
Cap 486 - Personal Data (Privacy) Ordinance 8
(6) In this section employees (僱員) includes any class of employee which the Commissioner specifies and in
subsection (3) includes former employees.
(Enacted 1995)
Section: 10 Delegations by Commissioner E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2), the Commissioner may delegate in writing any of his functions or powers under this
Ordinance to any prescribed officer subject to such terms and conditions, if any, as he thinks fit and specified in
the delegation.
(2) The Commissioner shall not delegate any of his functions or powers under-
(a) subsection (1);
(b) any provisions of any regulations made under this Ordinance which are specified in the regulations as
provisions which shall not be subject to subsection (1);
(c) any provisions of Schedule 2 which are specified in that Schedule as provisions which shall not be subject
to subsection (1).
(3) A delegate of the Commissioner-
(a) shall perform the delegated functions and may exercise the delegated powers as if the delegate were the
Commissioner; and
(b) shall be presumed to be acting in accordance with the relevant delegation in the absence of evidence to the
contrary.
(Enacted 1995)
Section: 11 Establishment of Personal Data (Privacy) Advisory
Committee
E.R. 1 of 2013 25/04/2013
Remarks:
For the saving and transitional provisions relating to the amendments made by the Resolution of the Legislative
Council (L.N. 130 of 2007), see paragraph (12) of that Resolution.
(1) There is hereby established a committee by the name of the Personal Data (Privacy) Advisory Committee for the
purpose of advising the Commissioner upon any matter relevant to the privacy of individuals in relation to
personal data or otherwise relevant to the operation of this Ordinance.
(2) The Committee shall consist of-
(a) the Commissioner, who shall be the chairman; and
(b) not less than 4 or more than 8 other persons, appointed by the Secretary for Constitutional and Mainland
Affairs, of whom-
(i) not less than 1 shall have not less than 5 years' experience in the processing of data; and
(ii) not more than 1 shall be a public officer.
(3) The members of the Committee appointed under subsection (2)(b) shall hold office for such period and upon
such terms as the Secretary for Constitutional and Mainland Affairs specifies in their respective appointments or
from time to time.
(4) A member of the Committee appointed under subsection (2)(b) may resign at any time by notice in writing
delivered to the Secretary for Constitutional and Mainland Affairs.
(5) The Committee may regulate its procedure.
(Amended L.N. 130 of 2007)
(Enacted 1995)
Section: 11A Immunity 18 of 2012 01/10/2012
(1) No civil liability is incurred by the person appointed to be the Commissioner under section 5(3) or a prescribed
officer in respect of anything done or omitted to be done by the person or officer in good faith in the
performance or purported performance of any function, or the exercise or purported exercise of any power,
imposed or conferred on the Commissioner or officer under this Ordinance.
(2) The protection conferred under subsection (1) on any person in respect of anything done or omitted to be done
Cap 486 - Personal Data (Privacy) Ordinance 9
does not in any way affect the civil liability of the Commissioner as a corporation sole for that thing.
(Added 18 of 2012 s. 5)
Part: 3 Codes of Practice E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 12 Approval of codes of practice by Commissioner E.R. 1 of 2013 25/04/2013
(1) Subject to subsections (8) and (9), for the purpose of providing practical guidance in respect of any requirements
under this Ordinance imposed on data users, the Commissioner may-
(a) approve and issue such codes of practice (whether prepared by him or not) as in his opinion are suitable for
that purpose; and
(b) approve such codes of practice issued or proposed to be issued otherwise than by him as in his opinion are
suitable for that purpose.
(2) Where a code of practice is approved under subsection (1), the Commissioner shall, by notice in the Gazette-
(a) identify the code concerned and specify the date on which its approval is to take effect; and
(b) specify for which of the requirements under this Ordinance the code is so approved.
(3) The Commissioner may-
(a) from time to time revise the whole or any part of any code of practice prepared by him under this section;
and
(b) approve any revision or proposed revision of the whole or any part of any code of practice for the time
being approved under this section,
and the provisions of subsection (2) shall, with the necessary modifications, apply in relation to the approval of
any revision under this subsection as they apply in relation to the approval of a code of practice under subsection
(1).
(4) The Commissioner may at any time withdraw his approval from any code of practice approved under this
section.
(5) Where under subsection (4) the Commissioner withdraws his approval from a code of practice approved under
this section, he shall, by notice in the Gazette, identify the code concerned and specify the date on which his
approval of it is to cease to have effect.
(6) References in this Ordinance to an approved code of practice are references to that code as it has effect for the
time being by virtue of any revision of the whole or any part of it approved under this section.
(7) The power of the Commissioner under subsection (1)(b) to approve a code of practice issued or proposed to be
issued otherwise than by him shall include power to approve a part of such a code and, accordingly, in this
Ordinance code of practice(實務守則) may be read as including a part of such a code.
(8) The Commissioner shall, not later than 6 months after the day on which this section comes into operation (or
within such further period, not exceeding 6 months, as the Secretary for Home Affairs may allow), approve a
code of practice under subsection (1) in respect of all or any requirements referred to in that subsection in so far
as such requirements relate to personal data which is personal identifiers. (Amended 18 of 2012 s. 2)
(9) The Commissioner shall, before approving a code of practice under subsection (1) or any revision or proposed
revision of the code under subsection (3), consult with-
(a) such bodies representative of data users to which the code or the code as so revised, as the case may be, will
apply (whether in whole or in part); and
(b) such other interested persons,
as he thinks fit.
(10) For the avoidance of doubt, it is hereby declared that different codes of practice may be approved under
subsection (1) (including any code of practice referred to in subsection (8)) for different classes of data users,
and may be so approved for the same or different requirements referred to in subsection (1).
(Enacted 1995)
Cap 486 - Personal Data (Privacy) Ordinance 10
Section: 13 Use of approved codes of practice in proceedings under
this Ordinance
E.R. 1 of 2013 25/04/2013
(1) A failure on the part of any data user to observe any provision of an approved code of practice shall not of itself
render the data user liable to any civil or criminal proceedings but where in any proceedings under this
Ordinance a data user is alleged to have contravened a requirement under this Ordinance, being a requirement
for which there was an approved code of practice at the time of the alleged contravention, subsection (2) shall
have effect with respect to such code in relation to those proceedings.
(2) Any provision of a code of practice which appears to a specified body to be relevant to a requirement under this
Ordinance alleged to have been contravened shall be admissible in evidence in the proceedings under this
Ordinance concerned and if it is proved that there was at any material time a failure to observe any provision of
the code which appears to that body to be relevant to any matter which it is necessary to prove in order to
establish a contravention of such requirement, that matter shall be taken as proved in the absence of evidence
that such requirement was in respect of that matter complied with otherwise than by way of observance of that
provision.
(3) In any proceedings under this Ordinance, a code of practice which appears to a specified body to be the subject
of a notice under section 12 shall be taken to be the subject of such notice in the absence of evidence to the
contrary.
(4) In this section-
proceedings under this Ordinance (根據本條例進行的法律程序) includes any criminal proceedings where a data
user is alleged to have committed an offence by reason of a contravention of a requirement under this Ordinance;
specified body (指明當局) means-
(a) a magistrate;
(b) a court; (Amended 18 of 2012 s. 6)
(c) the Administrative Appeals Board; or (Amended 18 of 2012 s. 6)
(d) the chairman of the Administrative Appeals Board. (Added 18 of 2012 s. 6)
(Enacted 1995)
Part: 4 Data User Returns and Register of Data Users E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 14 Data user returns E.R. 1 of 2013 25/04/2013
Remarks:
For the saving and transitional provisions relating to the amendments made by the Resolution of the Legislative
Council (L.N. 130 of 2007), see paragraph (12) of that Resolution.
(1) Subject to subsection (2), the Commissioner may, by notice in the Gazette, specify a class of data users to which
this section shall apply.
(2) The Commissioner shall, before specifying a class of data users in a notice under subsection (1), consult with-
(a) such bodies representative of data users belonging to that class; and
(b) such other interested persons,
as he thinks fit.
(3) This section shall not apply to a data user except a data user belonging to a class of data users specified in a
notice under subsection (1) which is in force.
(4) A data user shall submit to the Commissioner a return- (Amended 18 of 2012 s. 7)
(a) in the specified form;
(b) containing the prescribed information required by the return in relation to the data user;
(c) in the case of-
(i) a data user which belongs to the class of data users concerned on the day on which the notice under
subsection (1) specifying that class commences, not earlier than 3 months before, and not later than,
each anniversary of that day;
(ii) a data user which first belongs to the class of data users concerned on a day after the day on which the
Cap 486 - Personal Data (Privacy) Ordinance 11
notice under subsection (1) specifying that class commences, not earlier than 3 months before, and not
later than, each anniversary of that first-mentioned day; and
(d) accompanied by the prescribed fee.
(5) The Commissioner shall cause a notice to be published not less than once during every period of 6 months-
(a) in-
(i) the Gazette; and
(ii) not less than 1 Chinese language newspaper (and in the Chinese language) and not less than 1 English
language newspaper (and in the English language), each of which shall be a newspaper circulating
generally in Hong Kong; and
(b) subject to subsection (6), specifying the places at which and the hours during which data user returns are
available to data users for the purposes of this section. (Amended 18 of 2012 s. 7)
(6) The Commissioner shall not exercise his power under subsection (5)(b) to specify places which are Government
offices unless and until he has the approval in writing of the Secretary for Constitutional and Mainland Affairs to
do so. (Amended L.N. 130 of 2007)
(7) The Commissioner shall cause data user returns to be available to data users- (Amended 18 of 2012 s. 7)
(a) free of charge; and
(b) at the places and during the hours specified in the last notice published under subsection (5).
(8) Where any prescribed information contained in a data user return submitted under subsection (4) to the
Commissioner by a data user changes subsequent to the submission, then the data user shall serve a notice in
writing on the Commissioner specifying such change-
(a) if, but only if-
(i) such information is specified in the return as information to which this subsection applies; and
(ii) the return contains, or has annexed to it-
(A) a copy of this subsection; or
(B) a statement summarizing the requirement imposed by this subsection on the data user; and
(b) not later than 30 days after such change.
(9) It is hereby declared that-
(a) a notice under subsection (1) is subsidiary legislation; and (Amended 18 of 2012 s. 7)
(b) where a data user belongs to 2 or more classes of data users specified in 2 or more notices under subsection
(1) which are in force, then, for the purposes of this section, that data user shall be deemed to belong only to
that class of data users specified in the first of those notices to be published in the Gazette. (Amended 18 of
2012 s. 7)
(c) (Repealed 18 of 2012 s. 7)
(10) (Repealed 18 of 2012 s. 7)
(11) A data user who, in purported compliance with subsection (4) or (8), knowingly or recklessly in a data user
return or change notice supplies any information which is false or misleading in a material particular, commits
an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012
s. 7)
(Enacted 1995)
Section: 14A Verification of data user returns 18 of 2012 01/10/2012
(1) For the purpose of verifying the accuracy of information in a data user return or change notice, the
Commissioner may, by written notice served on any of the persons specified in subsection (2), reasonably
require the person—
(a) to provide any document, record, information or thing specified in the written notice; and
(b) to respond in writing to any question specified in the written notice.
(2) The persons are—
(a) the data user; and
(b) any other person whom the Commissioner has reasonable grounds to believe may be able to assist in
verifying any information in the data user return or change notice.
(3) A person on whom a notice is served under subsection (1) may refuse to provide any document, record,
information or thing, or any response to any question, specified in the notice, if the person is entitled or obliged
under any other Ordinance to do so.
Cap 486 - Personal Data (Privacy) Ordinance 12
(4) If, having regard to any document, record, information or thing, or any response to any question, provided under
subsection (1), the Commissioner has reasonable grounds to believe that any information in a data user return or
change notice is inaccurate, the Commissioner may, by written notice, require the data user to correct the
information in the data user return or change notice.
(5) Subject to subsection (3), a person on whom a notice is served under subsection (1) or (4) must comply with the
requirement within such reasonable period as is specified in the notice.
(6) A person who contravenes subsection (5) commits an offence and is liable on conviction to a fine at level 3.
(7) A person who, in purported compliance with a notice under subsection (1), knowingly or recklessly provides any
document, record, information or thing, or any response to any question, which is false or misleading in a
material particular, commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6
months.
(8) A data user who, in purported compliance with a notice under subsection (4), knowingly or recklessly in a data
user return or change notice supplies any information which is false or misleading in a material particular,
commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months.
(Added 18 of 2012 s. 8)
Section: 15 Register of data users E.R. 1 of 2013 25/04/2013
(1) The Commissioner must keep and maintain a register of data users who have submitted data user returns, using
information in those returns and in any change notices. (Replaced 18 of 2012 s. 9)
(2) The register shall-
(a) be in the form of a database; and
(b) contain, in respect of each data user who has submitted a data user return, such particulars of the
information supplied in that return and any change notice as the Commissioner thinks fit. (Amended 18 of
2012 s. 9)
(3) The Commissioner may, by notice in writing served on a data user, require the data user to submit a notice in the
specified form containing such prescribed information in relation to the data user as the Commissioner may
reasonably require in order to keep and maintain the register in so far as it relates to that data user, and the data
user shall so submit the second-mentioned notice within such period (being a period of not less than 30 days
after service of the first-mentioned notice) and in such manner as the Commissioner requires in the first-
mentioned notice. (Amended 18 of 2012 s. 9)
(4) Where any prescribed information submitted to the Commissioner under subsection (3) by a data user changes
subsequent to the submission, then the data user shall serve a notice in writing on the Commissioner specifying
such change-
(a) if, but only if-
(i) such information is specified in the notice concerned under that subsection as information to which this
subsection applies; and
(ii) the notice referred to in subparagraph (i) contains, or has annexed to it-
(A) a copy of this subsection; or
(B) a statement summarizing the requirement imposed by this subsection on the data user; and
(b) not later than 30 days after such change.
(4A) A data user who, in purported compliance with subsection (3) or (4), knowingly or recklessly in a notice
submitted to or served on the Commissioner supplies any information which is false or misleading in a material
particular, commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months.
(Added 18 of 2012 s. 9)
(5) If the Commissioner is satisfied that a person has ceased to be a data user, he may delete from the register any
particulars contained therein relating to that person in that person's capacity as a data user.
(6) A person who has ceased to be a data user may, by notice in the specified form served on the Commissioner,
request the Commissioner to delete from the register the particulars contained therein relating to that person in
that person's capacity as a data user, and the Commissioner shall, not later than 3 months after the date on which
he receives that notice, comply with that request unless it has been withdrawn by that person.
(7) A person who, in a notice served on the Commissioner under subsection (6), supplies any information which is
false or misleading in a material particular for the purpose of having the particulars contained in the register
relating to that person in that person’s capacity as a data user deleted from the register, commits an offence and
is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 9)
Cap 486 - Personal Data (Privacy) Ordinance 13
(Enacted 1995)
Section: 16 Inspection of register E.R. 1 of 2013 25/04/2013
(1) The Commissioner shall provide facilities for making the particulars contained in the register available for
inspection-
(a) by any person;
(b) in visible and legible form;
(c) during ordinary office hours; and
(d) free of charge.
(2) The Commissioner shall-
(a) on receipt of an application in the specified form from a person; and
(b) on payment of the prescribed fee,
provide a copy in writing of the particulars contained in the register in respect of the data user, or the class of
data users, specified in the application.
(Enacted 1995)
Section: 17 Register shall not limit, etc. operation of this Ordinance E.R. 1 of 2013 25/04/2013
(1) For the avoidance of doubt, it is hereby declared that-
(a) whether or not the register contains any particulars;
(b) any particulars contained in the register,
in respect of a data user shall not of itself-
(i) limit, restrict or qualify the operation of any of the provisions of this Ordinance (including section 2(5) and
the data protection principles) in relation to the data user;
(ii) exempt the data user from the operation of any of the provisions of this Ordinance.
(2) Subsection (1) shall not prejudice the operation of any limitation, restriction, qualification or exemption
provided for in the other provisions of this Ordinance.
(Enacted 1995)
Part: 5 Access to and Correction of Personal Data E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Part:
Division:
5
1
Access to Personal Data E.R. 1 of 2013 25/04/2013
(Added 18 of 2012 s. 10)
Section: 17A Interpretation of Part 5* E.R. 1 of 2013 25/04/2013
Without limiting the definition of relevant person in section 2(1), in this Part—
relevant person (有關人士), in relation to an individual, also includes a person authorized in writing by the
individual to make, on behalf of the individual—
(a) a data access request; or
(b) a data correction request.
(Added 18 of 2012 s. 10)
_____________________________________________________________________________
Note:
* (Amended E.R. 1 of 2013)
Section: 18 Data access request E.R. 1 of 2013 25/04/2013
(1) An individual, or a relevant person on behalf of an individual, may make a request-
Cap 486 - Personal Data (Privacy) Ordinance 14
(a) to be informed by a data user whether the data user holds personal data of which the individual is the data
subject;
(b) if the data user holds such data, to be supplied by the data user with a copy of such data.
(2) A data access request under both paragraphs of subsection (1) shall be treated as being a single request, and the
provisions of this Ordinance shall be construed accordingly.
(3) A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to the contrary, be
treated as being a data access request under both paragraphs of that subsection, and the provisions of this
Ordinance (including subsection (2)) shall be construed accordingly.
(4) A data user who, in relation to personal data-
(a) does not hold the data; but
(b) controls the use of the data in such a way as to prohibit the data user who does hold the data from
complying (whether in whole or in part) with a data access request which relates to the data,
shall be deemed to hold the data, and the provisions of this Ordinance (including this section) shall be construed
accordingly. (Amended 18 of 2012 s. 11)
(5) A person commits an offence if the person, in a data access request, supplies any information which is false or
misleading in a material particular for the purposes of having the data user—
(a) inform the person whether the data user holds any personal data which is the subject of the request; and
(b) if applicable, supply a copy of the data. (Added 18 of 2012 s. 11)
(6) A person who commits an offence under subsection (5) is liable on conviction to a fine at level 3 and to
imprisonment for 6 months. (Added 18 of 2012 s. 11)
(Enacted 1995)
Section: 19 Compliance with data access request E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2) and sections 20 and 28(5), a data user must comply with a data access request within
40 days after receiving the request by—
(a) if the data user holds any personal data which is the subject of the request—
(i) informing the requestor in writing that the data user holds the data; and
(ii) supplying a copy of the data; or
(b) if the data user does not hold any personal data which is the subject of the request, informing the requestor
in writing that the data user does not hold the data. (Replaced 18 of 2012 s. 12)
(1A) Despite subsection (1)(b), if—
(a) a data access request is made to the Hong Kong Police Force as to whether it holds any record of criminal
conviction of an individual; and
(b) it does not hold such record,
it must comply with the request by informing the requestor orally, within 40 days after receiving the request, that
it does not hold such record. (Added 18 of 2012 s. 12)
(2) A data user who is unable to comply with a data access request within the period specified in subsection (1) or
(1A) shall- (Amended 18 of 2012 s. 12)
(a) before the expiration of that period-
(i) by notice in writing inform the requestor that the data user is so unable and of the reasons why the data
user is so unable; and
(ii) comply with the request to the extent, if any, that the data user is able to comply with the request; and
(b) as soon as practicable after the expiration of that period, comply or fully comply, as the case may be,
with the request.
(3) A copy of the personal data to be supplied by a data user in compliance with a data access request shall-
(a) be supplied by reference to the data at the time when the request is received except that the copy may take
account of-
(i) any processing of the data-
(A) made between that time and the time when the copy is supplied; and
(B) that would have been made irrespective of the receipt of the request; and
(ii) subject to subsection (5), any correction to the data made between that time and the time when the
copy is supplied;
(b) where any correction referred to paragraph (a)(ii) has been made to the data, be accompanied by a notice
Cap 486 - Personal Data (Privacy) Ordinance 15
stating that the data has been corrected pursuant to that paragraph (or words to the like effect); and
(Amended 18 of 2012 s. 12)
(c) as far as practicable, be-
(i) intelligible unless the copy is a true copy of a document which-
(A) contains the data; and
(B) is unintelligible on its face;
(ii) readily comprehensible with any codes used by the data user adequately explained; and
(iii) in-
(A) subject to sub-subparagraph (B), the language specified in the request or, if no language is so
specified, the language in which the request is made (which may be the Chinese or English
language in either case);
(B) a language other than the language specified in the request or, if no language is so specified, the
language in which the request is made, if, but only if-
(I) the language in which the data is held is not the language specified in the request or, if no
language is so specified, the language in which the request is made, as the case may be; and
(Amended 18 of 2012 s. 12)
(II) subject to section 20(2)(b), the copy is a true copy of a document which contains the data;
(iv) without prejudice to the generality of subparagraph (iii) but subject to subsection (4), be in the form, or
one of the forms, if any, specified in the request;
(v) where subparagraph (iv) is not applicable, in such form as the data user thinks fit.
(4) Where-
(a) a data access request specifies the form or forms in which a copy of the personal data to be supplied in
compliance with the request is or are sought; and
(b) the data user concerned is unable to supply the copy in that form or any of those forms, as the case may be,
because it is not practicable for the data user to do so,
then the data user shall-
(i) where there is only one form in which it is practicable for the data user to supply the copy, supply the copy
in that form accompanied by a notice in writing informing the requestor that that form is the only form in
which it is practicable for the data user to supply the copy;
(ii) in any other case-
(A) as soon as practicable, by notice in writing inform the requestor-
(I) that it is not practicable for the data user to supply the copy in the form or any of the forms, as
the case may be, specified in the request;
(II) of the forms in which it is practicable for the data user to supply the copy; and
(III) that the requestor may, not later than 14 days after the requestor has received the notice, specify
in writing one of the forms referred to in sub-subparagraph (II) in which the copy is to be
supplied; and
(B) as soon as practicable, supply the copy-
(I) in the form specified in the response, if any, to the notice referred to in subparagraph (A);
(II) if there is no such response within the period specified in subparagraph (A)(III), supply the copy
in any one of the forms referred to in subparagraph (A)(II) as the data user thinks fit.
(5) Subparagraph (ii) of paragraph (a) and paragraph (b) of subsection (3) shall expire on the 1st anniversary of the
appointed day.
(Enacted 1995)
Section: 20 Circumstances in which data user shall or may refuse to
comply with data access request
E.R. 1 of 2013 25/04/2013
(1) A data user shall refuse to comply with a data access request-
(a) if the data user is not supplied with such information as the data user may reasonably require-
(i) in order to satisfy the data user as to the identity of the requestor;
(ii) where the requestor purports to be a relevant person, in order to satisfy the data user-
(A) as to the identity of the individual in relation to whom the requestor purports to be such a person;
and
(B) that the requestor is such a person in relation to that individual;
Cap 486 - Personal Data (Privacy) Ordinance 16
(b) subject to subsection (2), if the data user cannot comply with the request without disclosing personal data of
which any other individual is the data subject unless the data user is satisfied that the other individual has
consented to the disclosure of the data to the requestor; or
(c) in any other case, if compliance with the request is for the time being prohibited under this or any other
Ordinance. (Amended 18 of 2012 s. 13)
(2) Subsection (1)(b) shall not operate-
(a) so that the reference in that subsection to personal data of which any other individual is the data subject
includes a reference to information identifying that individual as the source of the personal data to which
the data access request concerned relates unless that information names or otherwise explicitly identifies
that individual;
(b) so as to excuse a data user from complying with the data access request concerned to the extent that the
request may be complied with without disclosing the identity of the other individual, whether by the
omission of names, or other identifying particulars, or otherwise.
(3) A data user may refuse to comply with a data access request if-
(a) the request is not in writing in the Chinese or English language;
(b) the data user is not supplied with such information as the data user may reasonably require to locate the
personal data to which the request relates;
(c) the request follows 2 or more similar requests made by-
(i) the individual who is the data subject in respect of the personal data to which the request relates;
(ii) one or more relevant persons on behalf of that individual; or
(iii) any combination of that individual and those relevant persons,
and it is unreasonable in all the circumstances for the data user to comply with the request;
(d) subject to subsection (4), any other data user controls the use of the data in such a way as to prohibit the
first-mentioned data user from complying (whether in whole or in part) with the request;
(e) the form in which the request shall be made has been specified under section 67 and the request is not made
in that form; (Amended 18 of 2012 s. 13)
(ea) the data user is entitled under this or any other Ordinance not to comply with the request; or (Added 18 of
2012 s. 13)
(f) in any other case, compliance with the request may for the time being be refused under this Ordinance,
whether by virtue of an exemption under Part VIII or otherwise.
(4) Subsection (3)(d) shall not operate so as to excuse a data user from complying with the data access request
concerned-
(a) in so far as the request relates to section 18(1)(a), to any extent;
(b) in so far as the request relates to section 18(1)(b), to any extent that the data user can comply with the
request without contravening the prohibition concerned.
(5) Despite any provision in any relevant Ordinance or its subsidiary legislation in relation to discovery and
inspection, in any proceedings under this Ordinance, a specified body—
(a) may, for the purpose of deciding on the issue as to whether a data user is required or entitled to refuse to
comply with a data access request under this section or deciding on any question related to that issue,
require the personal data which is the subject of the request to be made available for its inspection; and
(b) must not require the personal data to be disclosed to any party to the proceedings, whether by discovery or
otherwise, unless it has decided that the data user must comply with the request. (Added 18 of 2012 s. 13)
(6) In subsection (5)—
proceedings under this Ordinance (根據本條例進行的法律程序) has the same meaning given by section 13(4);
relevant Ordinance (有關條例) means—
(a) the High Court Ordinance (Cap 4);
(b) the District Court Ordinance (Cap 336); or
(c) the Administrative Appeals Board Ordinance (Cap 442);
specified body (指明當局) has the same meaning given by section 13(4). (Added 18 of 2012 s. 13)
(Amended E.R. 1 of 2013)
(Enacted 1995)
Cap 486 - Personal Data (Privacy) Ordinance 17
Section: 21 Notification of refusal to comply with data access request E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2), a data user who pursuant to section 20 refuses to comply with a data access request
shall, as soon as practicable but, in any case, not later than 40 days after receiving the request, by notice in
writing inform the requestor-
(a) of the refusal;
(b) subject to subsection (2), of the reasons for the refusal; and
(c) where section 20(3)(d) is applicable, of the name and address of the other data user concerned.
(2) Where-
(a) a data user has pursuant to section 20 refused to comply with a data access request; and
(b) the refusal also relates to section 18(1)(a) by virtue of section 63,
then the data user may, in the notice under subsection (1) concerned, in place of the matters of which the data
user is required to inform the requestor under that subsection, inform the requestor that the data user has no
personal data the existence of which he is required to disclose to the requestor (or words to the like effect).
(Enacted 1995)
Part:
Division:
5
2
Correction of Personal Data E.R. 1 of 2013 25/04/2013
(Added 18 of 2012 s. 14)
Section: 22 Data correction request E.R. 1 of 2013 25/04/2013
(1) Subject to subsections (1A) and (2), where- (Amended 18 of 2012 s. 15)
(a) a copy of personal data has been supplied by a data user in compliance with a data access request; and
(b) the individual, or a relevant person on behalf of the individual, who is the data subject considers that the
data is inaccurate, (Amended 18 of 2012 s. 15)
then that individual or relevant person, as the case may be, may make a request that the data user make the
necessary correction to the data.
(1A) If a person is a relevant person in relation to an individual only because the person has been authorized in
writing by the individual to make a data access request on behalf of the individual, the person is not entitled to
make a data correction request. (Added 18 of 2012 s. 15)
(2) A data user who, in relation to personal data-
(a) does not hold the data; but
(b) controls the processing of the data in such a way as to prohibit the data user who does hold the data from
complying (whether in whole or in part) with section 23(1) in relation to a data correction request which
relates to the data,
shall be deemed to be a data user to whom such a request may be made, and the provisions of this Ordinance
(including subsection (1)) shall be construed accordingly.
(3) Without prejudice to the generality of sections 23(1)(c) and 25(2), if a data user, subsequent to the receipt of a
data correction request but before complying with the request pursuant to section 24 or refusing to comply with
the request pursuant to section 25, discloses to a third party the personal data to which the request relates, then
the user shall take all practicable steps to advise the third party that the data is the subject of a data correction
request still under consideration by the user (or words to the like effect). (Amended 18 of 2012 s. 15)
(4) A person who, in a data correction request, supplies any information which is false or misleading in a material
particular for the purpose of having the personal data corrected as indicated in the request, commits an offence
and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 15)
(Enacted 1995)
Section: 23 Compliance with data correction request E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2) and section 24, a data user who is satisfied that personal data to which a data correction
request relates is inaccurate shall, not later than 40 days after receiving the request- (Amended 18 of 2012 s. 2)
(a) make the necessary correction to the data;
Cap 486 - Personal Data (Privacy) Ordinance 18
(b) supply the requestor with a copy of the data as so corrected; and
(c) subject to subsection (3), if-
(i) the data has been disclosed to a third party during the 12 months immediately preceding the day on
which the correction is made; and
(ii) the data user has no reason to believe that the third party has ceased using the data for the purpose
(including any directly related purpose) for which the data was disclosed to the third party,
take all practicable steps to supply the third party with a copy of the data as so corrected accompanied
by a notice in writing stating the reasons for the correction.
(2) A data user who is unable to comply with subsection (1) in relation to a data correction request within the period
specified in that subsection shall-
(a) before the expiration of that period-
(i) by notice in writing inform the requestor that the data user is so unable and of the reasons why the data
user is so unable; and
(ii) comply with that subsection to the extent, if any, that the data user is able to comply with that
subsection; and
(b) as soon as practicable after the expiration of that period, comply or fully comply, as the case may be, with
that subsection.
(3) A data user is not required to comply with subsection (1)(c) in any case where the disclosure concerned of the
personal data to the third party consists of the third party's inspection of a register or other like document-
(a) in which the data is entered or otherwise recorded; and
(b) which is available for inspection by the public,
but this subsection shall not apply if the third party has been supplied with a copy, certified by or under the
authority of the data user to be correct, of the data.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 24 Circumstances in which data user shall or may refuse to
comply with data correction request
E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2), a data user shall refuse to comply with section 23(1) in relation to a data correction
request if the data user is not supplied with such information as the data user may reasonably require-
(a) in order to satisfy the data user as to the identity of the requestor;
(b) where the requestor purports to be a relevant person, in order to satisfy the data user-
(i) as to the identity of the individual in relation to whom the requestor purports to be such a person; and
(ii) that the requestor is such a person in relation to that individual.
(2) Subsection (1) shall not apply to a data correction request where the requestor is the same person as the
requestor in respect of the data access request which gave rise to the data correction request.
(3) A data user may refuse to comply with section 23(1) in relation to a data correction request if-
(a) the request is not in writing in the Chinese or English language;
(b) the data user is not satisfied that the personal data to which the request relates is inaccurate; (Amended 18
of 2012 s. 2)
(c) the data user is not supplied with such information as the data user may reasonably require to ascertain in
what way the personal data to which the request relates is inaccurate; (Amended 18 of 2012 s. 2)
(d) the data user is not satisfied that the correction which is the subject of the request is accurate; or
(e) subject to subsection (4), any other data user controls the processing of the personal data to which the
request relates in such a way as to prohibit the first-mentioned data user from complying (whether in whole
or in part) with that section.
(4) Subsection (3)(e) shall not operate so as to excuse a data user from complying with section 23(1) in relation to
the data correction request concerned to the extent that the data user can comply with that section without
contravening the prohibition concerned.
(Enacted 1995)
Cap 486 - Personal Data (Privacy) Ordinance 19
Section: 25 Notification of refusal to comply with data correction
request, etc.
E.R. 1 of 2013 25/04/2013
(1) A data user who pursuant to section 24 refuses to comply with section 23(1) in relation to a data correction
request shall, as soon as practicable but, in any case, not later than 40 days after receiving the request, by notice
in writing inform the requestor-
(a) of the refusal and the reasons for the refusal; and
(b) where section 24(3)(e) is applicable, of the name and address of the other data user concerned.
(2) Without prejudice to the generality of subsection (1), where-
(a) the personal data to which a data correction request relates is an expression of opinion; and (Amended 18
of 2012 s. 2)
(b) the data user concerned is not satisfied that the opinion is inaccurate,
then the data user shall-
(i) make a note, whether annexed to that data or elsewhere-
(A) of the matters in respect of which the opinion is considered by the requestor to be inaccurate; and
(B) in such a way that that data cannot be used by a person (including the data user and a third party)
without the note being drawn to the attention of, and being available for inspection by, that person; and
(Amended 18 of 2012 s. 2)
(ii) attach a copy of the note to the notice referred to in subsection (1) which relates to that request.
(3) In this section, expression of opinion (意見表達) includes an assertion of fact which-
(a) is unverifiable; or
(b) in all the circumstances of the case, is not practicable to verify.
(Enacted 1995)
Part:
Division:
5
3
Miscellaneous E.R. 1 of 2013 25/04/2013
(Added 18 of 2012 s. 16)
Section: 26 Erasure of personal data no longer required E.R. 1 of 2013 25/04/2013
(1) A data user must take all practicable steps to erase personal data held by the data user where the data is no longer
required for the purpose (including any directly related purpose) for which the data was used unless- (Amended
18 of 2012 s. 17)
(a) any such erasure is prohibited under any law; or
(b) it is in the public interest (including historical interest) for the data not to be erased.
(2) For the avoidance of doubt, it is hereby declared that-
(a) a data user must take all practicable steps to erase personal data in accordance with subsection (1)
notwithstanding that any other data user controls (whether in whole or in part) the processing of the data;
(Amended 18 of 2012 s. 17)
(b) the first-mentioned data user shall not be liable in an action for damages at the suit of the second-mentioned
data user in respect of any such erasure.
(Enacted 1995)
Section: 27 Log book to be kept by data user E.R. 1 of 2013 25/04/2013
(1) A data user shall keep and maintain a log book-
(a) for the purposes of this Part;
(b) in the Chinese or English language; and
(c) such that any particulars entered in the log book pursuant to this section are not erased therefrom before the
expiration of-
(i) subject to subparagraph (ii), 4 years after the day on which they were so entered;
(ii) such longer or shorter period as may be prescribed, either generally or in any particular case, by
regulations made under section 70.
Cap 486 - Personal Data (Privacy) Ordinance 20
(2) A data user shall in accordance with subsection (3) enter in the log book-
(a) where pursuant to section 20 the data user refuses to comply with a data access request, particulars of the
reasons for the refusal;
(b) where pursuant to section 21(2) the data user does not comply with section 21(1), particulars of the
prejudice that would be caused to the interest protected by the exemption concerned under Part VIII if the
existence or non-existence of the personal data to which the data access request concerned relates was
disclosed; (Amended 18 of 2012 s. 2)
(c) where pursuant to section 24 the data user refuses to comply with section 23(1) in relation to a data
correction request, particulars of the reasons for the refusal;
(d) any other particulars required by regulations made under section 70 to be entered in the log book.
(3) The particulars required by subsection (2) to be entered by a data user in the log book shall be so entered-
(a) in the case of particulars referred to in paragraph (a) of that subsection, on or before the notice under section
21(1) is served in respect of the refusal to which those particulars relate;
(b) in the case of particulars referred to in paragraph (b) of that subsection, on or before the notice under
section 21(1) is served in respect of the refusal to which those particulars relate;
(c) in the case of particulars referred to in paragraph (c) of that subsection, on or before the notice under section
25(1) is served in respect of the refusal to which those particulars relate;
(d) in the case of particulars referred to in paragraph (d) of that subsection, within the period specified in
regulations made under section 70 in respect of those particulars.
(4) A data user shall-
(a) permit the Commissioner to inspect and copy the log book (or any part thereof) at any reasonable time; and
(b) without charge, afford the Commissioner such facilities and assistance as the Commissioner may
reasonably require for the purposes of such inspection and copying.
(Enacted 1995)
Section: 28 Imposition of fees by data user E.R. 1 of 2013 25/04/2013
(1) A data user shall not impose a fee for complying or refusing to comply with a data access request or data
correction request unless the imposition of the fee is expressly permitted by this section.
(2) Subject to subsections (3) and (4), a data user may impose a fee for complying with a data access request.
(3) No fee imposed for complying with a data access request shall be excessive.
(4) Where pursuant to section 19(3)(c)(iv) or (v) or (4)(ii)(B)(II) a data user may comply with a data access request
by supplying a copy of the personal data to which the request relates in one of 2 or more forms, the data user
shall not, and irrespective of the form in which the data user complies with the request, impose a fee for
complying with the request which is higher than the lowest fee the data user imposes for complying with the
request in any of those forms.
(5) A data user may refuse to comply with a data access request unless and until any fee imposed by the data user
for complying with the request has been paid.
(6) Where-
(a) a data user has complied with a data access request by supplying a copy of the personal data to which the
request relates; and
(b) the data subject, or a relevant person on behalf of the data subject, requests the data user to supply a further
copy of that data, (Amended 18 of 2012 s. 2)
then the data user may, and notwithstanding the fee, if any, that the data user imposed for complying with that
data access request, impose a fee for supplying that further copy which is not more than the administrative and
other costs incurred by the data user in supplying that further copy.
(Enacted 1995)
Section: 29 Service and language of certain notices E.R. 1 of 2013 25/04/2013
Without prejudice to the generality of section 68, where pursuant to a data access request or data correction request a
data user is required to, or may, inform a requestor of any matter by notice in writing, then the requestor shall be
deemed not to be so informed unless and until the requestor is served with the notice-
(a) in the language in which the request is made if that language is Chinese or English;
(b) in any other case, in the Chinese or English language as the data user thinks fit.
Cap 486 - Personal Data (Privacy) Ordinance 21
(Enacted 1995)
Part: 6 Matching Procedures and Transfers of Personal Data,
ETC.
E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 30 Matching procedure not to be carried out except with
consent of data subject, etc.
E.R. 1 of 2013 25/04/2013
(1) A data user shall not carry out, whether in whole or in part, a matching procedure-
(a) unless and until each individual who is a data subject of the personal data the subject of that procedure has
given his prescribed consent to the procedure being carried out;
(b) unless and until the Commissioner has consented under section 32 to the procedure being carried out;
(c) unless the procedure-
(i) belongs to a class of matching procedures specified in a notice under subsection (2); and
(ii) is carried out in accordance with the conditions, if any, specified in the notice; or
(d) unless it is required or permitted under any provision of any Ordinance specified in Schedule 4.
(2) For the purposes of this section, the Commissioner may, by notice in the Gazette, specify-
(a) a class of matching procedures;
(b) subject to subsection (3), the conditions, if any, subject to which a matching procedure belonging to that
class shall be carried out.
(3) The Commissioner shall, before specifying any conditions in a notice under subsection (2), consult with-
(a) such bodies representative of data users to which the conditions will apply (whether in whole or in part);
and
(b) such other interested persons,
as he thinks fit.
(4) It is hereby declared that a notice under subsection (2) is subsidiary legislation.
(5) Subject to subsection (6), a data user shall not take adverse action against an individual in consequence (whether
in whole or in part) of the carrying out of a matching procedure-
(a) unless the data user has served a notice in writing on the individual-
(i) specifying the adverse action it proposes to take and the reasons therefor; and
(ii) stating that the individual has 7 days after the receipt of the notice within which to show cause why
that action should not be taken; and
(b) until the expiration of those 7 days.
(6) Subsection (5) shall not operate to prevent a data user from taking adverse action against an individual if
compliance with the requirements of that subsection would prejudice any investigation into the commission of
an offence or the possible commission of an offence.
(Enacted 1995)
Section: 31 Matching procedure request E.R. 1 of 2013 25/04/2013
(1) A data user proposing to carry out, whether in whole or in part, a matching procedure may make a request-
(a) in the specified form;
(b) to the Commissioner; and
(c) seeking the Commissioner's consent under section 32 to the carrying out of that procedure.
(2) Where 2 or more data users may each make a matching procedure request in respect of the same matching
procedure, then any of those data users may make such a request on behalf of all those data users, and the
provisions of this Ordinance (including subsection (1)) shall be construed accordingly.
(3) Without prejudice to the generality of subsection (2), it is hereby declared that a matching procedure request
may be made in relation to 2 or more matching procedures, or a series of matching procedures, and the other
provisions of this Ordinance (including section 32) shall be construed accordingly.
(4) A data user who, in a matching procedure request made under subsection (1), supplies any information which is
false or misleading in a material particular for the purpose of obtaining the Commissioner’s consent to the
Cap 486 - Personal Data (Privacy) Ordinance 22
carrying out of the matching procedure to which the request relates, commits an offence and is liable on
conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 18)
(Enacted 1995)
Section: 32 Determination of matching procedure request E.R. 1 of 2013 25/04/2013
(1) The Commissioner shall determine a matching procedure request-
(a) not later than 45 days after receiving the request; and
(b) by taking into account the prescribed matters applicable to the request and-
(i) where he is satisfied as to those matters, serving a notice in writing on the requestor stating that he
consents to the carrying out of the matching procedure to which the request relates subject to the
conditions, if any, specified in the notice;
(ii) where he is not so satisfied, serving a notice in writing on the requestor stating-
(A) that he refuses to consent to the carrying out of the matching procedure to which the request
relates; and
(B) such of those matters in respect of which he is not so satisfied and the reasons why he is not so
satisfied.
(2) For the avoidance of doubt, it is hereby declared that a consent in a notice under subsection (1)(b)(i) to the
carrying out of a matching procedure to which a matching procedure request relates shall not operate to prevent
a data user who is neither the requestor nor, where section 31(2) applies to the request, any data user on whose
behalf such request was made, from carrying out, whether in whole or in part, the procedure.
(3) An appeal may be made to the Administrative Appeals Board-
(a) against-
(i) any conditions specified in a notice under subsection (1) (b)(i); or
(ii) any refusal specified in a notice under subsection (1) (b)(ii); and
(b) by the requestor on whom the notice was served or any data user on whose behalf the matching procedure
request concerned was made.
(4) In this section, prescribed matter (訂明事宜) means a matter specified in Schedule 5.
(5) A requestor who contravenes any conditions specified in a notice under subsection (1)(b)(i) commits an offence
and is liable on conviction to a fine at level 3. (Added 18 of 2012 s. 19)
(Enacted 1995)
Section: 33 Prohibition against transfer of personal data to place
outside Hong Kong except in specified circumstances
Remarks:
Not yet in operation
(1) This section shall not apply to personal data other than personal data the collection, holding, processing or use of
which-
(a) takes place in Hong Kong; or
(b) is controlled by a data user whose principal place of business is in Hong Kong.
(2) A data user shall not transfer personal data to a place outside Hong Kong unless-
(a) the place is specified for the purposes of this section in a notice under subsection (3);
(b) the user has reasonable grounds for believing that there is in force in that place any law which is
substantially similar to, or serves the same purposes as, this Ordinance;
(c) the data subject has consented in writing to the transfer;
(d) the user has reasonable grounds for believing that, in all the circumstances of the case-
(i) the transfer is for the avoidance or mitigation of adverse action against the data subject;
(ii) it is not practicable to obtain the consent in writing of the data subject to that transfer; and
(iii) if it was practicable to obtain such consent, the data subject would give it;
(e) the data is exempt from data protection principle 3 by virtue of an exemption under Part 8; or (Amended 18
of 2012 s. 2)
(f) the user has taken all reasonable precautions and exercised all due diligence to ensure that the data will not,
in that place, be collected, held, processed or used in any manner which, if that place were Hong Kong,
Cap 486 - Personal Data (Privacy) Ordinance 23
would be a contravention of a requirement under this Ordinance.
(3) Where the Commissioner has reasonable grounds for believing that there is in force in a place outside Hong
Kong any law which is substantially similar to, or serves the same purposes as, this Ordinance, he may, by
notice in the Gazette, specify that place for the purposes of this section.
(4) Where the Commissioner has reasonable grounds for believing that in a place specified in a notice under
subsection (3) there is no longer in force any law which is substantially similar to, or serves the same purposes
as, this Ordinance, he shall, either by repealing or amending that notice, cause that place to cease to be specified
for the purposes of this section.
(5) For the avoidance of doubt, it is hereby declared that-
(a) for the purposes of subsection (1)(b), a data user which is a company incorporated in Hong Kong is a data
user whose principal place of business is in Hong Kong;
(b) a notice under subsection (3) is subsidiary legislation; and
(c) this section shall not operate to prejudice the generality of section 50.
(Enacted 1995)
Section: 34 (Repealed 18 of 2012 s. 20) L.N. 5 of 2013 01/04/2013
Section: 35 Repeated collections of personal data in same
circumstances
E.R. 1 of 2013 25/04/2013
(1) A data user who-
(a) has complied with the provisions of data protection principle 1(3) in respect of the collection of any
personal data from the data subject (first collection); and
(b) on any subsequent occasion again collects personal data from the data subject (subsequent collection),
is not required to comply with those provisions in respect of the subsequent collection if, but only if-
(i) to comply with those provisions in respect of that subsequent collection would be to repeat, without any
material difference, what was done to comply with that principle in respect of the first collection; and
(ii) not more than 12 months have elapsed between the first collection and the subsequent collection.
(2) For the avoidance of doubt, it is hereby declared that subsection (1) shall not operate to prevent a subsequent
collection from becoming a first collection if, but only if, the data user concerned has complied with the
provisions of data protection principle 1(3) in respect of the subsequent collection.
(Enacted 1995)
Part: 6A Use of Personal Data in Direct Marketing and Provision of
Personal Data for Use in Direct Marketing
E.R. 1 of 2013 25/04/2013
(Part 6A added 18 of 2012 s. 21)
Part:
Division:
6A
1
Interpretation E.R. 1 of 2013 25/04/2013
Section: 35A Interpretation of Part 6A* E.R. 1 of 2013 25/04/2013
(1) In this Part—
consent (同意), in relation to a use of personal data in direct marketing or a provision of personal data for use in
direct marketing, includes an indication of no objection to the use or provision;
direct marketing (直接促銷) means—
(a) the offering, or advertising of the availability, of goods, facilities or services; or
(b) the solicitation of donations or contributions for charitable, cultural, philanthropic, recreational, political or
other purposes,
through direct marketing means;
Cap 486 - Personal Data (Privacy) Ordinance 24
direct marketing means (直接促銷方法) means—
(a) sending information or goods, addressed to specific persons by name, by mail, fax, electronic mail or other
means of communication; or
(b) making telephone calls to specific persons;
marketing subject (促銷標的), in relation to direct marketing, means—
(a) any goods, facility or service offered, or the availability of which is advertised; or
(b) any purpose for which donations or contributions are solicited;
permitted class of marketing subjects (許可類別促銷標的), in relation to a consent by a data subject to an intended
use or provision of personal data, means a class of marketing subjects—
(a) that is specified in the information provided to the data subject under section 35C(2)(b)(ii) or 35J(2)(b)(iv);
and
(b) in relation to which the consent is given;
permitted class of persons (許可類別人士), in relation to a consent by a data subject to an intended provision of
personal data, means a class of persons—
(a) that is specified in the information provided to the data subject under section 35J(2)(b)(iii); and
(b) in relation to which the consent is given;
permitted kind of personal data (許可種類個人資料), in relation to a consent by a data subject to an intended use
or provision of personal data, means a kind of personal data—
(a) that is specified in the information provided to the data subject under section 35C(2)(b)(i) or 35J(2)(b)(ii);
and
(b) in relation to which the consent is given;
response channel (回應途徑) means a channel provided by a data user to a data subject under section 35C(2)(c) or
35J(2)(c).
(2) For the purposes of this Part, a person provides personal data for gain if the person provides personal data in
return for money or other property, irrespective of whether—
(a) the return is contingent on any condition; or
(b) the person retains any control over the use of the data.
(Amended E.R. 1 of 2013)
_____________________________________________________________________________
Note:
* (Amended E.R. 1 of 2013)
Part:
Division:
6A
2
Use of Personal Data in Direct Marketing E.R. 1 of 2013 25/04/2013
Section: 35B Application L.N. 5 of 2013 01/04/2013
This Division does not apply in relation to the offering, or advertising of the availability, of—
(a) social services run, subvented or subsidized by the Social Welfare Department;
(b) health care services provided by the Hospital Authority or Department of Health; or
(c) any other social or health care services which, if not provided, would be likely to cause serious harm to the
physical or mental health of—
(i) the individual to whom the services are intended to be provided; or
(ii) any other individual.
Section: 35C Data user to take specified action before using personal
data in direct marketing
L.N. 5 of 2013 01/04/2013
(1) Subject to section 35D, a data user who intends to use a data subject’s personal data in direct marketing must
take each of the actions specified in subsection (2).
(2) The data user must—
Cap 486 - Personal Data (Privacy) Ordinance 25
(a) inform the data subject—
(i) that the data user intends to so use the personal data; and
(ii) that the data user may not so use the data unless the data user has received the data subject’s consent
to the intended use;
(b) provide the data subject with the following information in relation to the intended use—
(i) the kinds of personal data to be used; and
(ii) the classes of marketing subjects in relation to which the data is to be used; and
(c) provide the data subject with a channel through which the data subject may, without charge by the data
user, communicate the data subject’s consent to the intended use.
(3) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data
user.
(4) The information provided under subsection (2)(a) and (b) must be presented in a manner that is easily
understandable and, if in written form, easily readable.
(5) Subject to section 35D, a data user who uses a data subject’s personal data in direct marketing without taking
each of the actions specified in subsection (2) commits an offence and is liable on conviction to a fine of
$500000 and to imprisonment for 3 years.
(6) In any proceedings for an offence under subsection (5), it is a defence for the data user charged to prove that the
data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
(7) In any proceedings for an offence under subsection (5), the burden of proving that this section does not apply
because of section 35D lies on the data user.
Section: 35D Circumstances under which section 35C does not apply L.N. 5 of 2013 01/04/2013
(1) If, before the commencement date—
(a) a data subject had been explicitly informed by a data user in an easily understandable and, if informed in
writing, easily readable manner of the intended use or use of the data subject’s personal data in direct
marketing in relation to a class of marketing subjects;
(b) the data user had so used any of the data;
(c) the data subject had not required the data user to cease to so use any of the data; and
(d) the data user had not, in relation to the use, contravened any provision of this Ordinance as in force as at the
time of the use,
then section 35C does not apply in relation to the intended use or use, on or after the commencement date, of the
data subject’s relevant personal data, as updated from time to time, in direct marketing in relation to the class
of marketing subjects.
(2) If—
(a) a data subject’s personal data is provided to a data user by a person other than the data subject (third
person); and
(b) the third person has by notice in writing to the data user—
(i) stated that sections 35J and 35K have been complied with in relation to the provision of data; and
(ii) specified the class of marketing subjects in relation to which the data may be used in direct marketing
by the data user, as consented to by the data subject,
then section 35C does not apply in relation to the intended use or use by the data user of the data in direct
marketing in relation to that class of marketing subjects.
(3) In this section—
*commencement date (本部生效日期) means the date on which this Part comes into operation;
relevant personal data (有關個人資料), in relation to a data subject, means any personal data of the data subject
over the use of which a data user had control immediately before the commencement date.
_____________________________________________________________________________
Note:
* Commencement date : 1 April 2013
Cap 486 - Personal Data (Privacy) Ordinance 26
Section: 35E Data user must not use personal data in direct marketing
without data subject’s consent
L.N. 5 of 2013 01/04/2013
(1) A data user who has complied with section 35C must not use the data subject’s personal data in direct
marketing unless—
(a) the data user has received the data subject’s consent to the intended use of personal data, as described in
the information provided by the data user under section 35C(2)(b), either generally or selectively;
(b) if the consent is given orally, the data user has, within 14 days from receiving the consent, sent a written
confirmation to the data subject, confirming—
(i) the date of receipt of the consent;
(ii) the permitted kind of personal data; and
(iii) the permitted class of marketing subjects; and
(c) the use is consistent with the data subject’s consent.
(2) For the purposes of subsection (1)(c), the use of personal data is consistent with the data subject’s consent if—
(a) the personal data falls within a permitted kind of personal data; and
(b) the marketing subject in relation to which the data is used falls within a permitted class of marketing
subjects.
(3) A data subject may communicate to a data user the consent to a use of personal data either through a response
channel or other means.
(4) A data user who contravenes subsection (1) commits an offence and is liable on conviction to a fine of $500000
and to imprisonment for 3 years.
(5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the
data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
Section: 35F Data user must notify data subject when using personal
data in direct marketing for first time
L.N. 5 of 2013 01/04/2013
(1) A data user must, when using a data subject’s personal data in direct marketing for the first time, inform the
data subject that the data user must, without charge to the data subject, cease to use the data in direct marketing
if the data subject so requires.
(2) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data
user.
(3) A data user who contravenes subsection (1) commits an offence and is liable on conviction to a fine of $500000
and to imprisonment for 3 years.
(4) In any proceedings for an offence under subsection (3), it is a defence for the data user charged to prove that the
data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
Section: 35G Data subject may require data user to cease to use
personal data in direct marketing
L.N. 5 of 2013 01/04/2013
(1) A data subject may, at any time, require a data user to cease to use the data subject’s personal data in direct
marketing.
(2) Subsection (1) applies irrespective of whether the data subject—
(a) has received from the data user the information required to be provided in relation to the use of personal
data under section 35C(2); or
(b) has earlier given consent to the data user or a third person to the use.
(3) A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data
subject, comply with the requirement.
(4) A data user who contravenes subsection (3) commits an offence and is liable on conviction to a fine of $500000
and to imprisonment for 3 years.
(5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the
data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
(6) This section does not affect the operation of section 26.
Cap 486 - Personal Data (Privacy) Ordinance 27
Section: 35H Prescribed consent for using personal data in direct
marketing under data protection principle 3
L.N. 5 of 2013 01/04/2013
Despite section 2(3), where a data user requires, under data protection principle 3, the prescribed consent of a data
subject for using any personal data of the data subject in direct marketing, the data user is to be taken to have obtained
the consent if the data user has not contravened section 35C, 35E or 35G.
Part:
Division:
6A
3
Provision of Personal Data for Use in Direct Marketing E.R. 1 of 2013 25/04/2013
Section: 35I Application L.N. 5 of 2013 01/04/2013
(1) This Division does not apply if a data user provides, otherwise than for gain, personal data of a data subject to
another person for use by that other person in offering, or advertising the availability, of—
(a) social services run, subvented or subsidized by the Social Welfare Department;
(b) health care services provided by the Hospital Authority or Department of Health; or
(c) any other social or health care services which, if not provided, would be likely to cause serious harm to the
physical or mental health of—
(i) the individual to whom the services are intended to be provided; or
(ii) any other individual.
(2) This Division does not apply if a data user provides personal data of a data subject to an agent of the data user
for use by the agent in carrying out direct marketing on the data user’s behalf.
Section: 35J Data user to take specified action before providing
personal data
L.N. 5 of 2013 01/04/2013
(1) A data user who intends to provide a data subject’s personal data to another person for use by that other person
in direct marketing must take each of the actions specified in subsection (2).
(2) The data user must—
(a) inform the data subject in writing—
(i) that the data user intends to so provide the personal data; and
(ii) that the data user may not so provide the data unless the data user has received the data subject’s
written consent to the intended provision;
(b) provide the data subject with the following written information in relation to the intended provision—
(i) if the data is to be provided for gain, that the data is to be so provided;
(ii) the kinds of personal data to be provided;
(iii) the classes of persons to which the data is to be provided; and
(iv) the classes of marketing subjects in relation to which the data is to be used; and
(c) provide the data subject with a channel through which the data subject may, without charge by the data
user, communicate the data subject’s consent to the intended provision in writing.
(3) Subsection (1) applies irrespective of whether the personal data is collected from the data subject by the data
user.
(4) The information provided under subsection (2)(a) and (b) must be presented in a manner that is easily
understandable and easily readable.
(5) A data user who provides personal data of a data subject to another person for use by that other person in direct
marketing without taking each of the actions specified in subsection (2) commits an offence and is liable on
conviction—
(a) if the data is provided for gain, to a fine of $1000000 and to imprisonment for 5 years; or
(b) if the data is provided otherwise than for gain, to a fine of $500000 and to imprisonment for 3 years.
(6) In any proceedings for an offence under subsection (5), it is a defence for the data user charged to prove that the
data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
Cap 486 - Personal Data (Privacy) Ordinance 28
Section: 35K Data user must not provide personal data for use in direct
marketing without data subject’s consent
L.N. 5 of 2013 01/04/2013
(1) A data user who has complied with section 35J must not provide the data subject’s personal data to another
person for use by that other person in direct marketing unless—
(a) the data user has received the data subject’s written consent to the intended provision of personal data, as
described in the information provided by the data user under section 35J(2)(b), either generally or
selectively;
(b) if the data is provided for gain, the intention to so provide was specified in the information under section
35J(2)(b)(i); and
(c) the provision is consistent with the data subject’s consent.
(2) For the purposes of subsection (1)(c), the provision of personal data is consistent with the data subject’s
consent if—
(a) the personal data falls within a permitted kind of personal data;
(b) the person to whom the data is provided falls within a permitted class of persons; and
(c) the marketing subject in relation to which the data is to be used falls within a permitted class of marketing
subjects.
(3) A data subject may communicate to a data user the consent to a provision of personal data either through a
response channel or other written means.
(4) A data user who contravenes subsection (1) commits an offence and is liable on conviction—
(a) if the data user provides the personal data for gain, to a fine of $1000000 and to imprisonment for 5 years;
or
(b) if the data user provides the personal data otherwise than for gain, to a fine of $500000 and to imprisonment
for 3 years.
(5) In any proceedings for an offence under subsection (4), it is a defence for the data user charged to prove that the
data user took all reasonable precautions and exercised all due diligence to avoid the commission of the offence.
Section: 35L Data subject may require data user to cease to provide
personal data for use in direct marketing
L.N. 5 of 2013 01/04/2013
(1) A data subject who has been provided with information by a data user under section 35J(2)(b) may, at any time,
require the data user—
(a) to cease to provide the data subject’s personal data to any other person for use by that other person in
direct marketing; and
(b) to notify any person to whom the data has been so provided to cease to use the data in direct marketing.
(2) Subsection (1) applies irrespective of whether the data subject has earlier given consent to the provision of the
personal data.
(3) A data user who receives a requirement from a data subject under subsection (1) must, without charge to the data
subject, comply with the requirement.
(4) If a data user is required to notify a person to cease to use a data subject’s personal data in direct marketing
under a requirement referred to in subsection (1)(b), the data user must so notify the person in writing.
(5) A person who receives a written notification from a data user under subsection (4) must cease to use the personal
data in direct marketing in accordance with the notification.
(6) A data user who contravenes subsection (3) commits an offence and is liable on conviction—
(a) if the contravention involves a provision of personal data of a data subject for gain, to a fine of $1000000
and to imprisonment for 5 years; or
(b) in any other case, to a fine of $500000 and to imprisonment for 3 years.
(7) A person who contravenes subsection (5) commits an offence and is liable on conviction to a fine of $500000
and to imprisonment for 3 years.
(8) In any proceedings for an offence under subsection (6) or (7), it is a defence for the data user or person charged
to prove that the data user or person took all reasonable precautions and exercised all due diligence to avoid the
commission of the offence.
Cap 486 - Personal Data (Privacy) Ordinance 29
(9) This section does not affect the operation of section 26.
Section: 35M Prescribed consent for providing personal data for use in
direct marketing under data protection principle 3
L.N. 5 of 2013 01/04/2013
Despite section 2(3), where a data user requires, under data protection principle 3, the prescribed consent of a data
subject for providing any personal data of the data subject to another person for use in direct marketing, the data user
is to be taken to have obtained the consent if the data user has not contravened section 35J, 35K or 35L.
Part: 7 Inspections, Complaints and Investigations E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 36 Inspections of personal data systems E.R. 1 of 2013 25/04/2013
Without prejudice to the generality of section 38, the Commissioner may carry out an inspection of-
(a) any personal data system used by a data user; or
(b) any personal data system used by a data user belonging to a class of data users,
for the purposes of ascertaining information to assist the Commissioner in making recommendations-
(i) to-
(A) where paragraph (a) is applicable, the relevant data user;
(B) where paragraph (b) is applicable, the class of data users to which the relevant data user belongs; and
(ii) relating to the promotion of compliance with the provisions of this Ordinance, in particular the data
protection principles, by the relevant data user, or the class of data users to which the relevant data user
belongs, as the case may be.
(Enacted 1995)
Section: 37 Complaints E.R. 1 of 2013 25/04/2013
(1) An individual, or a relevant person on behalf of an individual, may make a complaint to the Commissioner about
an act or practice-
(a) specified in the complaint; and
(b) that-
(i) has been done or engaged in, or is being done or engaged in, as the case may be, by a data user
specified in the complaint;
(ii) relates to personal data of which the individual is or, in any case in which the data user is relying upon
an exemption under Part 8, may be, the data subject; and
(iii) may be a contravention of a requirement under this Ordinance (including section 28(4)).
(2) Where 2 or more individuals may each make a complaint about the same act or practice, then any of those
individuals, or any relevant person on behalf of any of those individuals, may make such a complaint on behalf
of all those individuals, and the provisions of this Ordinance (including subsection (1)) shall be construed
accordingly.
(3) A complaint shall be-
(a) in writing in the Chinese or English language; or
(b) in such other form as the Commissioner may accept.
(4) It shall be the duty of the Commissioner and each prescribed officer who has been employed under section
9(1)(a) to provide appropriate assistance to an individual, or a relevant person on behalf of an individual, who
wishes to make a complaint and requires assistance to formulate the complaint.
(Amended E.R. 1 of 2013)
(Enacted 1995)
Section: 38 Investigations by Commissioner E.R. 1 of 2013 25/04/2013
Where the Commissioner-
Cap 486 - Personal Data (Privacy) Ordinance 30
(a) receives a complaint; or
(b) has reasonable grounds to believe that an act or practice-
(i) has been done or engaged in, or is being done or engaged in, as the case may be, by a data user;
(ii) relates to personal data; and
(iii) may be a contravention of a requirement under this Ordinance,
then-
(i) where paragraph (a) is applicable, the Commissioner shall, subject to section 39, carry out an investigation
in relation to the relevant data user to ascertain whether the act or practice specified in the complaint is a
contravention of a requirement under this Ordinance;
(ii) where paragraph (b) is applicable, the Commissioner may carry out an investigation in relation to the
relevant data user to ascertain whether the act or practice referred to in that paragraph is a contravention of a
requirement under this Ordinance.
(Enacted 1995)
Section: 39 Restrictions on investigations initiated by complaints E.R. 1 of 2013 25/04/2013
(1) Notwithstanding the generality of the powers conferred on the Commissioner by this Ordinance, the
Commissioner may refuse to carry out or decide to terminate an investigation initiated by a complaint if-
(Amended 18 of 2012 s. 22)
(a) the complainant (or, if the complainant is a relevant person, the individual in respect of whom the
complainant is such a person) has had actual knowledge of the act or practice specified in the complaint for
more than 2 years immediately preceding the date on which the Commissioner received the complaint,
unless the Commissioner is satisfied that in all the circumstances of the case it is proper to carry out or not
to terminate, as the case may be, the investigation;
(b) the complaint is made anonymously;
(c) the complainant cannot be identified or traced;
(d) none of the following conditions is fulfilled in respect of the act or practice specified in the complaint-
(i) either-
(A) the complainant (or, if the complainant is a relevant person, the individual in respect of whom the
complainant is such a person) was resident in Hong Kong; or
(B) the relevant data user was able to control, in or from Hong Kong, the collection, holding,
processing or use of the personal data concerned,
at any time the act or practice was done or engaged in, as the case may be;
(ii) the complainant (or, if the complainant is a relevant person, the individual in respect of whom the
complainant is such a person) was in Hong Kong at any time the act or practice was done or engaged
in, as the case may be;
(iii) in the opinion of the Commissioner, the act or practice done or engaged in, as the case may be, may
prejudice the enforcement of any right, or the exercise of any privilege, acquired or accrued in Hong
Kong by the complainant (or, if the complainant is a relevant person, the individual in respect of whom
the complainant is such a person); or
(e) the Commissioner is satisfied that the relevant data user has not been a data user for a period of not less than
2 years immediately preceding the date on which the Commissioner received the complaint.
(2) The Commissioner may refuse to carry out or decide to terminate an investigation initiated by a complaint if he
is of the opinion that, having regard to all the circumstances of the case- (Amended 18 of 2012 s. 22)
(a) the complaint, or a complaint of a substantially similar nature, has previously initiated an investigation as a
result of which the Commissioner was of the opinion that there had been no contravention of a requirement
under this Ordinance;
(b) the act or practice specified in the complaint is trivial;
(c) the complaint is frivolous or vexatious or is not made in good faith;
(ca) the primary subject matter of the complaint, as shown by the act or practice specified in it, is not related to
privacy of individuals in relation to personal data; or (Added 18 of 2012 s. 22)
(d) any investigation or further investigation is for any other reason unnecessary.
(3) Where the Commissioner refuses under this section to carry out an investigation initiated by a complaint, he
shall, as soon as practicable but, in any case, not later than 45 days after receiving the complaint, by notice in
writing served on the complainant accompanied by a copy of subsection (4), inform the complainant- (Amended
Cap 486 - Personal Data (Privacy) Ordinance 31
18 of 2012 s. 22)
(a) of the refusal; and
(b) of the reasons for the refusal.
(3A) If the Commissioner decides to terminate an investigation initiated by a complaint before its completion, the
Commissioner must, as soon as practicable by notice in writing served on the complainant accompanied by a
copy of subsection (4), inform the complainant—
(a) of the decision; and
(b) of the reasons for the decision. (Added 18 of 2012 s. 22)
(4) An appeal may be made to the Administrative Appeals Board-
(a) against any refusal or termination specified in a notice under subsection (3) or (3A); and
(b) by the complainant on whom the notice was served (or, if the complainant is a relevant person, the
individual in respect of whom the complainant is such a person, or either).
(Amended 18 of 2012 s. 22)
(Enacted 1995)
Section: 40 Commissioner may carry out or continue investigation
initiated by complaint notwithstanding withdrawal of
complaint
E.R. 1 of 2013 25/04/2013
Where the Commissioner is of the opinion that it is in the public interest so to do, he may carry out or continue an
investigation initiated by a complaint notwithstanding that the complainant has withdrawn the complaint and, in any
such case, the provisions of this Ordinance shall apply to the complaint and the complainant as if the complaint had
not been withdrawn.
(Enacted 1995)
Section: 41 Commissioner to inform relevant data user of inspection
or investigation
E.R. 1 of 2013 25/04/2013
(1) The Commissioner shall, before carrying out an inspection or, subject to subsection (2), an investigation, by
notice in writing served on the relevant data user, inform the data user of his intention to carry out the inspection
or investigation, as the case may be.
(2) The Commissioner is not required to comply with subsection (1) in the case of any investigation in respect of
which he has reasonable grounds to believe that to so comply may prejudice the purposes of the investigation.
(Enacted 1995)
Section: 42 Power of entry on premises for the purposes of an
inspection or investigation
E.R. 1 of 2013 25/04/2013
(1) Subject to subsections (3) and (8), the Commissioner may, for the purposes of an inspection-
(a) where the personal data system, or any part thereof, the subject of the inspection is situated in-
(i) non-domestic premises, enter the premises at any reasonable time;
(ii) domestic premises, enter the premises with the consent of any person (other than a minor) resident
therein;
(b) carry out in the premises the inspection.
(2) Subject to subsections (3) and (8), the Commissioner may, for the purposes of an investigation-
(a) enter any premises-
(i) occupied by the relevant data user; or
(ii) in which is situated the personal data system, or any part thereof, used by the relevant data user;
(b) carry out in the premises the investigation.
(3) Subject to subsections (4) and (5), the Commissioner shall, not less than 14 days before exercising his power
under subsection (1) or (2) in respect of any premises, by notice in writing served on the relevant data user,
inform the data user-
(a) of the premises in respect of which he proposes to exercise that power; and
(b) that the power will not be so exercised before the expiration of 14 days after service of the notice.
Cap 486 - Personal Data (Privacy) Ordinance 32
(4) Without prejudice to the generality of subsection (5), where any domestic premises are specified in a notice
under subsection (3) in respect of which the Commissioner proposes to exercise his power under subsection (2),
then the Commissioner shall not exercise that power in respect of those premises unless and until a person (other
than a minor) resident therein consents thereto before the expiration of 14 days after service of the notice.
(5) The Commissioner may, pursuant to a warrant issued under subsection (6), exercise his power under subsection
(2) in respect of the premises specified in the warrant without complying with subsection (3).
(6) A magistrate may, if satisfied by information upon oath by the Commissioner or any prescribed officer that there
are reasonable grounds for believing that the purposes of any investigation may be substantially prejudiced if the
Commissioner were required to comply with subsection (3) before exercising his power under subsection (2) in
respect of any premises, issue a warrant-
(a) in the form specified in Part 1 of Schedule 6; and
(b) in respect of those premises.
(7) A magistrate may, if satisfied by information upon oath by the Commissioner or any prescribed officer that there
are reasonable grounds for believing that the purposes of an investigation may be substantially prejudiced if the
Commissioner is prevented by the operation of subsection (4) from exercising his power under subsection (2) in
respect of any domestic premises, issue a warrant-
(a) in the form specified in Part 2 of Schedule 6; and
(b) authorizing the Commissioner to exercise that power in respect of those premises.
(8) The Commissioner shall not exercise his power under subsection (1) or (2) in respect of any premises in such a
way as to unduly disrupt any operations being carried out in the premises, whether by the relevant data user or
any other person.
(9) Where the Commissioner exercises his power under subsection (1) or (2), the relevant data user shall, without
charge, afford the Commissioner such facilities and assistance as the Commissioner may reasonably require for
the purposes of the inspection or investigation concerned.
(10) Where the Commissioner, pursuant to a warrant issued under subsection (6), exercises his power under
subsection (2) in respect of the premises specified in the warrant, he shall produce the warrant for inspection by
any person found in those premises who questions his authority to exercise that power in respect of those
premises.
(11) In this section and Schedule 6-
domestic premises (住宅處所) means any premises which are constructed or intended to be used for habitation;
non-domestic premises (非住宅處所) means any premises other than domestic premises;
premises (處所) means-
(a) any building where no part of the building is separately occupied, and includes any land appertaining to the
building;
(b) in any other case, any part of a building which is separately occupied, and includes any land appertaining to
such part.
(Enacted 1995)
Section: 43 Proceedings of Commissioner E.R. 1 of 2013 25/04/2013
(1) Subject to the provisions of this Ordinance, the Commissioner may, for the purposes of any investigation-
(a) be furnished with any information, document or thing, from such persons, and make such inquiries, as he
thinks fit; and
(b) regulate his procedure in such manner as he thinks fit.
(2) Any hearing for the purposes of an investigation shall be carried out in public unless-
(a) the Commissioner is of the opinion that, in all the circumstances of the case, the investigation should be
carried out in private; or
(b) if the investigation was initiated by a complaint, the complainant requests in writing that the investigation
be carried out in private.
(3) Counsel and solicitors shall not have any right of audience before the Commissioner at any hearing for the
purposes of an investigation, but may appear before him if he thinks fit.
(4) It shall not be necessary for the Commissioner to hold any hearing for the purposes of an investigation and no
person shall be entitled to be heard by the Commissioner.
(5) If at any time during the course of an investigation it appears to the Commissioner that there may be sufficient
Cap 486 - Personal Data (Privacy) Ordinance 33
grounds for him to make any report or recommendation that may criticize or adversely affect any person he shall
give to the person an opportunity to be heard.
(Enacted 1995)
Section: 44 Evidence E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2) and section 45, the Commissioner may, for the purposes of any investigation, summon
before him any person who-
(a) in the opinion of the Commissioner, is able to give any information relevant to those purposes;
(b) where the investigation was initiated by a complaint, is the complainant (or, if the complainant is a relevant
person, the individual in respect of whom the complainant is such a person, or both),
and may examine any such person and require him to furnish to the Commissioner any information and to
produce any document or thing which, in the opinion of the Commissioner, is relevant to those purposes and
which may be in the possession or under the control of any such person.
(2) Where-
(a) an investigation has been initiated by a complaint;
(b) the complaint relates, whether in whole or in part, to personal data referred to in section 61(1);
(c) the Commissioner has, for the purposes of that investigation, under subsection (1)(a) summoned before him
a person; and
(d) that person asserts, in response to any requirement under subsection (1) by the Commissioner to furnish him
with information or to produce a document or thing, that-
(i) to comply with that requirement would directly or indirectly disclose the identity of the individual
from whom that data was collected (whether in whole or in part); or (Amended 18 of 2012 s. 23)
(ii) he is not required to comply with that requirement by virtue of any common law privilege,
then-
(i) notwithstanding any other provision of this Ordinance, the Commissioner shall not serve an enforcement
notice on that person in relation to that requirement;
(ii) the Commissioner may, not later than 28 days after that assertion is made known to him, make an
application to the Court of First Instance for an order directing that person to comply with that requirement;
(Amended 25 of 1998 s. 2)
(iii) the Court of First Instance may make the order if, but only if, it is satisfied, having regard to all the
circumstances (including the circumstances of the complainant), that- (Amended 25 of 1998 s. 2)
(A) if the act or practice specified in the complaint were proven to be a contravention of a requirement
under this Ordinance, the contravention would be of sufficient gravity to warrant that person
complying with the requirement referred to in paragraph (d);
(B) that investigation would be substantially prejudiced if the requirement referred to in paragraph (d)
were not compiled with;
(C) it is in the public interest, having regard to the benefit likely to accrue to that investigation, that the
requirement referred to in paragraph (d) be complied with; and
(D) in any case to which paragraph (d)(ii) is applicable, the common law privilege asserted does not apply;
and
(iv) on the hearing of the application, the Commissioner, that person and the complainant shall each be entitled
to be heard on the application and to call, examine and cross-examine any witness.
(3) Where-
(a) a person has complied with a requirement referred to in subsection (2)(d) the subject of an assertion referred
to in that subsection; and
(b) the result (whether in whole or in part) of the investigation to which that requirement relates is that the
Commissioner is of the opinion that the individual concerned referred to in subsection (2)(d)(i) has not
contravened a requirement under this Ordinance in relation to the matter the subject of the complaint which
initiated the investigation,
then, notwithstanding any other provision of this Ordinance, neither the Commissioner nor any prescribed
officer shall disclose the identity of that individual to the complainant.
(4) The Court of First Instance may, of its own volition or on an application made to it for the purpose, by order
reverse, vary or discharge an order made under subsection (2)(iii) or suspend the operation of such an order.
(Amended 25 of 1998 s. 2)
Cap 486 - Personal Data (Privacy) Ordinance 34
(5) Provision may be made by rules of court-
(a) with respect to applications to the Court of First Instance under subsection (2)(iii) or (4);
(b) generally with respect to procedure before the Court of First Instance in relation to any such application.
(Amended 25 of 1998 s. 2)
(6) Subsection (5) is without prejudice to the generality of any existing power to make rules.
(7) The Commissioner may administer an oath for the purposes of an examination under subsection (1) if he thinks
fit.
(8) It is hereby declared that-
(a) no obligation to maintain secrecy or other restriction, imposed by law, upon the disclosure of any
information, document or other thing, that is or has been in the possession or under the control of any
person referred to in subsection (1), shall apply to its disclosure for the purposes of an investigation; and
(b) any requirement by the Commissioner that any such information, document or thing as is referred to in
paragraph (a) be disclosed or produced for the purposes of an investigation shall be sufficient authority for
its disclosure or production to the Commissioner.
(9) The Commissioner may pay the reasonable expenses of complainants (including, if the complainant is a relevant
person, the individual in respect of whom the complainant is such a person) and witnesses incurred during the
course of an investigation.
(10) A person who contravenes subsection (3) commits an offence and is liable on conviction to a fine at level 3 and
to imprisonment for 6 months. (Added 18 of 2012 s. 23)
(Enacted 1995)
Section: 45 Protection of witnesses, etc. E.R. 1 of 2013 25/04/2013
(1) Every person shall have the same privileges in relation to the giving of information, the answering of questions,
and the production of documents and things, for the purposes of an investigation, as witnesses have in civil
proceedings in the High Court but any enactment or rule of law which authorizes or requires the withholding of
any document or thing, or the refusal to answer any question, on the ground that the disclosure of the document
or thing or the answering of the question, as the case may be, would be injurious to the public interest, shall not
apply in respect of any investigation. (Amended 25 of 1998 s. 2; 18 of 2012 s. 24)
(2) Except on the trial of any person for perjury in respect of his sworn testimony, or for an offence under this
Ordinance, no statement made or answer given by that or any other person in the course of any investigation
shall be admissible in evidence against any person, before any magistrate or in any court or at any inquiry or in
any other proceedings, and no evidence in respect of an investigation shall be given against any person.
(3) Where the giving of any information or the answering of any question or the production of any document or
thing would involve the disclosure, without the consent of the Chief Executive, of the deliberations of the
Executive Council, the Commissioner shall not require the information or answer to be given or, as the case may
be, the document or thing to be produced. (Amended 34 of 1999 s. 3)
(Enacted 1995)
Section: 46 Commissioner, etc. to maintain secrecy E.R. 1 of 2013 25/04/2013
(1) Subject to subsections (2), (3), (7) and (8), the Commissioner and every prescribed officer shall maintain secrecy
in respect of all matters that come to their actual knowledge in the performance of their functions and the
exercise of their powers under this Part. (Amended 18 of 2012 s. 25)
(2) Subsection (1) shall not operate so as to prevent the Commissioner or any prescribed officer from-
(a) subject to subsection (8), disclosing any matter if the disclosure is necessary for the proper performance of
the Commissioner’ s functions or the proper exercise of the Commissioner’ s powers under this
Ordinance; (Added 18 of 2012 s. 25)
(b) disclosing in the course of proceedings-
(i) for an offence under this Ordinance; and
(ii) before any court or magistrate,
any matter relevant to those proceedings;
(c) reporting evidence of any crime to such authority as he considers appropriate;
(d) disclosing to a person any matter referred to in subsection (1) which, in the opinion of the Commissioner or
prescribed officer, may be ground for a complaint by that person. (Amended 18 of 2012 s. 25)
Cap 486 - Personal Data (Privacy) Ordinance 35
(3) Subject to subsection (4), the Commissioner may disclose in any report made by him under this Ordinance any
matter that in his opinion ought to be disclosed in order to establish grounds for his findings and
recommendations other than a matter the disclosure of which in his opinion would involve the disclosure of
personal data that is exempt from data protection principle 6 by virtue of an exemption under Part 8. (Amended
18 of 2012 s. 25)
(4) If a report is made by the Commissioner on an inspection or investigation, and the report contains personal data,
the Commissioner must not publish the report unless- (Amended 18 of 2012 s. 25)
(a) a copy of the report in the form in which it is to be published has been supplied to the relevant data user;
(b) that copy is accompanied by a notice in writing inviting the data user to advise the Commissioner, in
writing and not later than 28 days after being served with the copy, whether-
(i) in the opinion of the data user there is any matter in the copy the disclosure of which would involve the
disclosure of personal data that is exempt from the provisions of data protection principle 6 by virtue
of an exemption under Part 8; and (Amended 18 of 2012 s. 25)
(ii) the data user objects to the disclosure of the matter; and
(c) either-
(i) the period referred to in paragraph (b) has expired without the Commissioner receiving any such
advice; or
(ii) such advice is received by the Commissioner and-
(A) the Commissioner deletes from the report the matter the subject of the advice; or
(B) the Commissioner decides not to delete that matter from the report and-
(I) the period referred to in subsection (6) expires without the data user making an appeal
under that subsection against that decision; or
(II) such an appeal is unsuccessful or withdrawn.
(5) Where the Commissioner makes a decision referred to in subsection (4)(c)(ii)(B), he shall serve on the relevant
data user who gave the advice concerned a notice in writing-
(a) stating his decision;
(b) informing the data user that he may appeal under subsection (6) against that decision; and
(c) accompanied by a copy of this section.
(6) An appeal may be made to the Administrative Appeals Board against a decision of the Commissioner referred to
in subsection (4)(c)(ii)(B) by the relevant data user not later than 14 days after the notice under subsection (5)
stating that decision has been served on the data user.
(7) The Commissioner may, for the purpose of enabling or assisting an authority of a place outside Hong Kong to
perform a relevant function of that authority, disclose matters to that authority, if—
(a) that authority has undertaken to be bound by the secrecy requirements imposed by the Commissioner; and
(b) in the opinion of the Commissioner, there is in force in that place any law which is substantially similar to,
or serves the same purposes as, this Ordinance. (Added 18 of 2012 s. 25)
(8) The Commissioner may, for the proper performance of the Commissioner’s functions or the proper exercise of
the Commissioner’s powers under this Ordinance, disclose matters to an authority of a place outside Hong
Kong that performs a relevant function, if—
(a) that authority has undertaken to be bound by the secrecy requirements imposed by the Commissioner; and
(b) any of the conditions specified in subsection (10) is satisfied. (Added 18 of 2012 s. 25)
(9) In subsections (7) and (8)—
relevant function (有關職能), in relation to an authority of a place outside Hong Kong, means a function relating to
investigation into a suspected contravention, and enforcement, of legal or regulatory requirements in that place
concerning the protection of privacy of individuals in relation to personal data. (Added 18 of 2012 s. 25)
(10) The conditions are—
(a) in the opinion of the Commissioner, there is in force in that place any law which is substantially similar to,
or serves the same purposes as, this Ordinance;
(b) the data subject to whom the matter relates has consented in writing to the disclosure;
(c) the Commissioner has reasonable grounds for believing that, in all the circumstances of the case—
(i) the disclosure is for the avoidance or mitigation of adverse action against the data subject;
(ii) it is not practicable to obtain the consent in writing of the data subject to that disclosure; and
(iii) if it was practicable to obtain such consent, the data subject would give it;
(d) the personal data to which the matters relate is exempt from the provisions of data protection principle 3
Cap 486 - Personal Data (Privacy) Ordinance 36
because of an exemption under Part 8; or
(e) the Commissioner has taken all reasonable precautions and exercised all due diligence to ensure that the
personal data to which the matters relate will not, in that place, be collected, held, processed or used in any
manner which, if that place were Hong Kong, would be a contravention of a requirement under this
Ordinance. (Added 18 of 2012 s. 25)
(11) A person who contravenes subsection (1) commits an offence and is liable on conviction to a fine at level 3 and
to imprisonment for 6 months. (Added 18 of 2012 s. 25)
(Amended E.R. 1 of 2013)
(Enacted 1995)
Section: 47 Persons to be informed of result of inspection or
investigation
E.R. 1 of 2013 25/04/2013
(1) Where the Commissioner has completed an inspection, he shall, in such manner and at such time as he thinks fit,
inform the relevant data user of-
(a) the result of the inspection;
(b) any recommendations arising from the inspection that the Commissioner thinks fit to make relating to the
promotion of compliance with the provisions of this Ordinance, in particular the data protection principles,
by the data user;
(c) any report arising from the inspection that he proposes to publish under section 48; and
(d) such other comments arising from the inspection as he thinks fit to make.
(2) Where the Commissioner has completed an investigation, he shall, in such manner and at such time as he thinks
fit, inform the relevant data user of-
(a) the result of the investigation;
(b) any recommendations arising from the investigation that the Commissioner thinks fit to make relating to the
promotion of compliance with the provisions of this Ordinance, in particular the data protection principles,
by the data user;
(c) any report arising from the investigation that he proposes to publish under section 48;
(d) whether or not he has decided to serve an enforcement notice on the data user in consequence of the
investigation; and
(e) such other comments arising from the investigation as he thinks fit to make.
(2A) If the Commissioner decides to serve an enforcement notice on a data user in consequence of an investigation,
the Commissioner may serve the notice at the same time when informing the data user of the information
relating to the investigation under subsection (2). (Added 18 of 2012 s. 26)
(3) Where the Commissioner has completed an investigation initiated by a complaint, he shall, in such manner and
at such time as he thinks fit, inform the complainant of-
(a) the result of the investigation;
(b) any recommendations made to the relevant data user under subsection (2)(b);
(c) any report arising from the investigation that he proposes to publish under section 48;
(d) any comments made by or on behalf of the relevant data user on any such recommendations or report;
(e) whether or not he has served, or has decided to serve, an enforcement notice on the relevant data user in
consequence of the investigation;
(f) if the Commissioner has not so served, and has decided not to so serve, such enforcement notice, his right to
object thereto under subsection (4); and
(g) such other comments arising from the investigation as he thinks fit to make.
(3A) Subsection (3) does not apply if the complainant has withdrawn the complaint. (Added 18 of 2012 s. 26)
(4) The complainant (or, if the complainant is a relevant person, the individual in respect of whom the complainant
is such a person, or either) may appeal to the Administrative Appeals Board against a decision of the
Commissioner-
(a) to the effect that he has not served, and has decided not to serve, an enforcement notice on the relevant data
user in consequence of the investigation concerned; and
(b) of which the complainant was informed in the notice concerned under subsection (3) served on him.
(Amended 18 of 2012 s. 26)
(Enacted 1995)
Cap 486 - Personal Data (Privacy) Ordinance 37
Section: 48 Reports by Commissioner E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (3), the Commissioner may, after completing an inspection where section 36(b) is
applicable, publish a report-
(a) setting out any recommendations arising from the inspection that the Commissioner thinks fit to make
relating to the promotion of compliance with the provisions of this Ordinance, in particular the data
protection principles, by the class of data users to which the relevant data user belongs; and
(b) in such manner as he thinks fit.
(2) Subject to subsection (3), the Commissioner may, after completing an investigation and if he is of the opinion
that it is in the public interest to do so, publish a report-
(a) setting out-
(i) the result of the investigation;
(ii) any recommendations arising from the investigation that the Commissioner thinks fit to make relating
to the promotion of compliance with the provisions of this Ordinance, in particular the data protection
principles, by the class of data users to which the relevant data user belongs; and
(iii) such other comments arising from the investigation as he thinks fit to make; and
(b) in such manner as he thinks fit.
(3) Subject to subsection (4), a report published under subsection (1) or (2) shall be so framed as to prevent the
identity of any individual being ascertained from it. (Amended 18 of 2012 s. 27)
(4) Subsection (3) shall not apply to any individual who is-
(a) the Commissioner or a prescribed officer;
(b) the relevant data user.
(Enacted 1995)
Section: 49 Cases in which sections 47 and 48 shall not apply E.R. 1 of 2013 25/04/2013
Where-
(a) the Commissioner has completed an investigation (and whether or not the investigation was initiated by a
complaint);
(b) the result of the investigation is that the act or practice the subject of the investigation is not a contravention
of a requirement under this Ordinance because of an exemption under Part 8; and
(c) the interest protected by that exemption would be likely to be prejudiced if sections 47 and 48 applied in
relation to the investigation,
then-
(i) those sections shall not apply in relation to the investigation; and
(ii) the Commissioner shall, in such manner and at such time as he thinks fit-
(A) inform the relevant data user of the result of the investigation and such other comments arising from
the investigation as he thinks fit;
(B) if the investigation was initiated by a complaint, inform the complainant that the result of the
investigation is that he is satisfied that the act or practice the subject of the investigation is not a
contravention of a requirement under this Ordinance (or words to the like effect).
(Amended E.R. 1 of 2013)
(Enacted 1995)
Section: 50 Enforcement notices E.R. 1 of 2013 25/04/2013
(1) If, following the completion of an investigation, the Commissioner is of the opinion that the relevant data user is
contravening or has contravened a requirement under this Ordinance, the Commissioner may serve on the data
user a notice in writing, directing the data user to remedy and, if appropriate, prevent any recurrence of the
contravention. (Replaced 18 of 2012 s. 28)
(1A) An enforcement notice under subsection (1) must—
(a) state that the Commissioner is of the opinion referred to in subsection (1) and the reason for that opinion;
(b) specify—
(i) the requirement which, in the opinion of the Commissioner, is being or has been contravened; and
Cap 486 - Personal Data (Privacy) Ordinance 38
(ii) the act or omission that constitutes the contravention;
(c) specify the steps that the data user must take (including ceasing any act or practice) to remedy and, if
appropriate, prevent any recurrence of the contravention;
(d) specify the date on or before which the steps must be taken; and
(e) be accompanied by a copy of this section. (Added 18 of 2012 s. 28)
(1B) The date specified in subsection (1A)(d) must be a date which is not earlier than the expiry of the period
specified in subsection (7) within which an appeal against the notice may be made. (Added 18 of 2012 s. 28)
(2) In deciding whether to serve an enforcement notice the Commissioner shall consider whether the contravention
to which the notice relates has caused or is likely to cause damage or distress to any individual who is the data
subject of any personal data to which the contravention relates. (Amended 18 of 2012 s. 28)
(3) The steps specified in an enforcement notice to remedy and, if appropriate, prevent any recurrence of any
contravention to which the notice relates may be framed—
(a) to any extent by reference to any approved code of practice; and
(b) so as to afford the relevant data user a choice between different ways of remedying and, if appropriate,
preventing any recurrence of the contravention. (Replaced 18 of 2012 s. 28)
(4) Subject to subsection (5), the period specified in an enforcement notice for taking the steps specified in it shall
not expire before the end of the period specified in subsection (7) within which an appeal against the notice may
be made and, if such an appeal is made, those steps need not be taken pending the determination or withdrawal
of the appeal.
(5) If the Commissioner is of the opinion that by reason of special circumstances the steps specified in an
enforcement notice should be taken as a matter of urgency-
(a) he may include a statement to that effect in the notice together with the reasons why he is of that opinion;
(b) where such a statement is so included, subsection (4) shall not apply but the notice shall not require those
steps to be taken before the end of the period of 7 days beginning with the date on which the notice was
served.
(6) The Commissioner may cancel an enforcement notice by notice in writing served on the relevant data user.
(7) An appeal may be made to the Administrative Appeals Board against an enforcement notice by the relevant data
user not later than 14 days after the notice was served.
(8) Where the Commissioner-
(a) forms an opinion referred to in subsection (1) in respect of the relevant data user at any time before the
completion of an investigation; and
(b) is also of the opinion that, by reason of special circumstances, an enforcement notice should be served on
the relevant data user as a matter of urgency,
he may so serve such notice notwithstanding that the investigation has not been completed and, in any such case-
(i) the Commissioner shall, without prejudice to any other matters to be included in such notice, specify in the
notice the reasons as to why he is of the opinion referred to in paragraph (b); and
(ii) the other provisions of this Ordinance (including this section) shall be construed accordingly.
(Enacted 1995)
Section: 50A Offences relating to enforcement notices 18 of 2012 01/10/2012
(1) A data user who contravenes an enforcement notice commits an offence and is liable—
(a) on a first conviction—
(i) to a fine at level 5 and to imprisonment for 2 years; and
(ii) if the offence continues after the conviction, to a daily penalty of $1000; and
(b) on a second or subsequent conviction—
(i) to a fine at level 6 and to imprisonment for 2 years; and
(ii) if the offence continues after the conviction, to a daily penalty of $2000.
(2) In any proceedings for an offence under subsection (1), it is a defence for the data user charged to show that the
data user exercised all due diligence to comply with the enforcement notice.
(3) A data user who, having complied with an enforcement notice, intentionally does the same act or makes the
same omission in contravention of the requirement under this Ordinance, as specified in the enforcement notice
under section 50(1A)(b), commits an offence and is liable on conviction—
(a) to a fine at level 5 and to imprisonment for 2 years; and
Cap 486 - Personal Data (Privacy) Ordinance 39
(b) if the offence continues after the conviction, to a daily penalty of $1000.
(Added 18 of 2012 s. 29)
Section: 50B Offences relating to failure to comply with requirements of
Commissioner etc.
18 of 2012 01/10/2012
(1) A person commits an offence if the person—
(a) without lawful excuse, obstructs, hinders or resists the Commissioner or a prescribed officer in performing
the functions or exercising the powers of the Commissioner or the officer under this Part;
(b) without lawful excuse, fails to comply with any lawful requirement of the Commissioner or a prescribed
officer under this Part; or
(c) in the course of the performance or exercise by the Commissioner or a prescribed officer of functions or
powers under this Part—
(i) makes to the Commissioner or the officer a statement which the person knows to be false or does not
believe to be true; or
(ii) otherwise knowingly misleads the Commissioner or the officer.
(2) A person who commits an offence under subsection (1) is liable on conviction to a fine at level 3 and to
imprisonment for 6 months.
(Added 18 of 2012 s. 29)
Part: 8 Exemptions E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 51 Interpretation E.R. 1 of 2013 25/04/2013
Where any personal data is exempt from any provision of this Ordinance by virtue of this Part, then, in respect of that
data and to the extent of that exemption, that provision neither confers any right nor imposes any requirement on any
person, and the other provisions of this Ordinance which relate (whether directly or indirectly) to that provision shall
be construed accordingly.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 51A Performance of judicial functions E.R. 1 of 2013 25/04/2013
(1) Personal data held by a court, a magistrate or a judicial officer in the course of performing judicial functions is
exempt from the provisions of the data protection principles and Parts 4 and 5 and sections 36 and 38(b).
(2) In this section—
judicial officer (司法人員) has the same meaning given by section 2 of the Judicial Officers Recommendation
Commission Ordinance (Cap 92).
(Added 18 of 2012 s. 30)
Section: 52 Domestic purposes E.R. 1 of 2013 25/04/2013
Personal data held by an individual and-
(a) concerned only with the management of his personal, family or household affairs; or
(b) so held only for recreational purposes,
is exempt from the provisions of the data protection principles, Parts 4 and 5 and sections 36 and 38(b).
(Amended 18 of 2012 s. 2. E.R. 1 of 2013)
(Enacted 1995)
Section: 53 Employment - staff planning E.R. 1 of 2013 25/04/2013
Personal data which consists of information relevant to any staff planning proposal to- (Amended 18 of 2012 s. 2)
Cap 486 - Personal Data (Privacy) Ordinance 40
(a) fill any series of positions of employment which are presently, or may become, unfilled; or
(b) cease any group of individuals' employment,
is exempt from the provisions of data protection principle 6 and section 18(1)(b).
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 54 Employment - transitional provisions E.R. 1 of 2013 25/04/2013
(1) Personal data-
(a) held by a data user-
(i) immediately before the appointed day;
(ii) who is the employer of the data subject; and
(iii) relating to the employment of the subject; and
(b) provided by an individual on the implicit or explicit condition that the subject would not have access to the
data,
is exempt from the provisions of data protection principle 6 and section 18(1)(b) until the expiration of 7 years
immediately following the enactment of this Ordinance.
(2) Personal data-
(a) to which subsection (1)(a) applies; or
(b) held by a data user-
(i) but not so held at any time before the appointed day;
(ii) who is the employer of the data subject; and
(iii) relating to the employment of the subject,
is exempt from the provisions of data protection principle 6 and section 18(1)(b) until 1 July 1996.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 55 Relevant process E.R. 1 of 2013 25/04/2013
(1) Personal data the subject of a relevant process is exempt from the provisions of data protection principle 6 and
section 18(1)(b) until the completion of that process. (Amended 18 of 2012 s. 2)
(2) In this section-
completion (完成), in relation to a relevant process, means the making of the determination concerned referred to in
paragraph (a) of the definition of relevant process;
relevant process (有關程序)-
(a) subject to paragraph (b), means any process whereby personal data is considered by one or more persons for
the purpose of determining, or enabling there to be determined- (Amended 18 of 2012 s. 2)
(i) the suitability, eligibility or qualifications of the data subject for-
(A) employment or appointment to office;
(B) promotion in employment or office or continuance in employment or office;
(C) removal from employment or office; or
(D) the awarding of contracts, awards (including academic and professional qualifications),
scholarships, honours or other benefits;
(ii) whether any contract, award (including academic and professional qualifications), scholarship, honour
or benefit relating to the data subject should be continued, modified or cancelled; or
(iii) whether any disciplinary action should be taken against the data subject for a breach of the terms of his
employment or appointment to office;
(b) does not include any such process where no appeal, whether under an Ordinance or otherwise, may be made
against any such determination.
(Enacted 1995)
Section: 56 Personal references E.R. 1 of 2013 25/04/2013
Personal data held by a data user which consists of a personal reference- (Amended 18 of 2012 s. 2)
Cap 486 - Personal Data (Privacy) Ordinance 41
(a) given by an individual other than in the ordinary course of his occupation; and
(b) relevant to another individual's suitability or otherwise to fill any position of employment or office which is
presently, or may become, unfilled,
is exempt from the provisions of data protection principle 6 and section 18(1)(b)- (Amended 18 of 2012 s. 2)
(i) in any case, unless the individual referred to in paragraph (a) has informed the data user in writing that he
has no objection to the reference being seen by the individual referred to in paragraph (b) (or words to the
like effect); or
(ii) in the case of a reference given on or after the day on which this section comes into operation, until the
individual referred to in paragraph (b) has been informed in writing that he has been accepted or rejected to
fill that position or office (or words to the like effect),
whichever first occurs.
(Enacted 1995)
Section: 57 Security, etc. in respect of Hong Kong E.R. 1 of 2013 25/04/2013
(1) Personal data held by or on behalf of the Government for the purposes of safeguarding security, defence or
international relations in respect of Hong Kong is exempt from the provisions of data protection principle 6 and
section 18(1)(b) where the application of those provisions to the data would be likely to prejudice any of the
matters referred to in this subsection. (Amended 18 of 2012 s. 2)
(2) Personal data is exempt from the provisions of data protection principle 3 in any case in which- (Amended 18 of
2012 s. 2)
(a) the use of the data is for any of the purposes referred to in subsection (1) (and whether or not the data is
held for any of those purposes); and (Amended 18 of 2012 s. 2)
(b) the application of those provisions in relation to such use would be likely to prejudice any of the matters
referred to in that subsection,
and in any proceedings against any person for a contravention of any of those provisions it shall be a defence to
show that he had reasonable grounds for believing that failure to so use the data would have been likely to
prejudice any of those matters.
(3) Any question whether an exemption under subsection (1) is or at any time was required in respect of any
personal data may be determined by the Chief Executive or Chief Secretary for Administration; and a certificate
signed by the Chief Executive or Chief Secretary for Administration certifying that the exemption is or at any
time was so required shall be evidence of that fact. (Amended L.N. 362 of 1997; 34 of 1999 s. 3)
(4) For the purposes of subsection (2), a certificate signed by the Chief Executive or Chief Secretary for
Administration certifying that personal data is or has been used for any purpose referred to in subsection (1)
shall be evidence of that fact. (Amended L.N. 362 of 1997; 34 of 1999 s. 3; 18 of 2012 s. 2)
(5) The Chief Executive or Chief Secretary for Administration may, in a certificate referred to in subsection (3) or
(4), in respect of the personal data to which the certificate relates and for the reasons specified in that certificate,
direct the Commissioner not to carry out an inspection or investigation and, in any such case, the Commissioner
shall comply with the direction. (Amended L.N. 362 of 1997; 34 of 1999 s. 3)
(6) A document purporting to be a certificate referred to in subsection (3) or (4) shall be received in evidence and, in
the absence of evidence to the contrary, shall be deemed to be such a certificate.
(7) In this section-
international relations (國際關係) includes relations with any international organization;
security (保安) includes the prevention or preclusion of persons (including persons detained in accordance with the
provisions of the Immigration Ordinance (Cap 115)) entering and remaining in Hong Kong who do not have the
right to enter and remain in Hong Kong.
(Enacted 1995)
Section: 58 Crime, etc. E.R. 1 of 2013 25/04/2013
(1) Personal data held for the purposes of-
(a) the prevention or detection of crime;
(b) the apprehension, prosecution or detention of offenders;
(c) the assessment or collection of any tax or duty;
Cap 486 - Personal Data (Privacy) Ordinance 42
(d) the prevention, preclusion or remedying (including punishment) of unlawful or seriously improper conduct,
or dishonesty or malpractice, by persons;
(e) the prevention or preclusion of significant financial loss arising from-
(i) any imprudent business practices or activities of persons; or
(ii) unlawful or seriously improper conduct, or dishonesty or malpractice, by persons;
(f) ascertaining whether the character or activities of the data subject are likely to have a significantly adverse
impact on any thing-
(i) to which the discharge of statutory functions by the data user relates; or
(ii) which relates to the discharge of functions to which this paragraph applies by virtue of subsection (3);
or
(g) discharging functions to which this paragraph applies by virtue of subsection (3),
is exempt from the provisions of data protection principle 6 and section 18(1)(b) where the application of those
provisions to the data would be likely to- (Amended 18 of 2012 s. 31)
(i) prejudice any of the matters referred to in this subsection; or
(ii) directly or indirectly identify the person who is the source of the data.
(1A) In subsection (1)(c), tax (稅項) includes any tax of a territory outside Hong Kong if-
(a) arrangements having effect under section 49(1A) of the Inland Revenue Ordinance (Cap 112) are made with
the government of that territory; and
(b) that tax is the subject of a provision of the arrangements that requires disclosure of information concerning
tax of that territory. (Added 1 of 2010 s. 9)
(2) Personal data is exempt from the provisions of data protection principle 3 in any case in which- (Amended 18 of
2012 s. 31)
(a) the use of the data is for any of the purposes referred to in subsection (1) (and whether or not the data is
held for any of those purposes); and (Amended 18 of 2012 s. 31)
(b) the application of those provisions in relation to such use would be likely to prejudice any of the matters
referred to in that subsection,
and in any proceedings against any person for a contravention of any of those provisions it shall be a defence to
show that he had reasonable grounds for believing that failure to so use the data would have been likely to
prejudice any of those matters.
(3) Paragraphs (f)(ii) and (g) of subsection (1) apply to any functions of a financial regulator-
(a) for protecting members of the public against financial loss arising from-
(i) dishonesty, incompetence, malpractice or seriously improper conduct by persons-
(A) concerned in the provision of banking, insurance, investment or other financial services;
(B) concerned in the management of companies;
(BA) concerned in the administration of provident fund schemes registered under the Mandatory
Provident Fund Schemes Ordinance (Cap 485); (Added 4 of 1998 s. 14)
(C) concerned in the management of occupational retirement schemes within the meaning of the
Occupational Retirement Schemes Ordinance (Cap 426); or
(D) who are shareholders in companies; or
(ii) the conduct of discharged or undischarged bankrupts;
(b) for maintaining or promoting the general stability or effective working of any of the systems which provide
any of the services referred to in paragraph (a)(i)(A); or
(c) specified for the purposes of this subsection in a notice under subsection (4).
(4) For the purposes of subsection (3), the Chief Executive may, by notice in the Gazette, specify a function of a
financial regulator. (Amended 34 of 1999 s. 3)
(5) It is hereby declared that-
(a) subsection (3) shall not operate to prejudice the generality of the operation of paragraphs (a), (b), (c), (d)
and (f)(i) of subsection (1) in relation to a financial regulator;
(b) a notice under subsection (4) is subsidiary legislation.
(6) In this section—
crime (罪行) means—
(a) an offence under the laws of Hong Kong; or
(b) if personal data is held or used in connection with legal or law enforcement cooperation between Hong
Kong and a place outside Hong Kong, an offence under the laws of that place;
Cap 486 - Personal Data (Privacy) Ordinance 43
offender (犯罪者) means a person who commits a crime. (Added 18 of 2012 s. 31)
(Enacted 1995)
Section: 58A Protected product and relevant records under Interception
of Communications and Surveillance Ordinance
E.R. 1 of 2013 25/04/2013
(1) A personal data system is exempt from the provisions of this Ordinance to the extent that it is used by a data user
for the collection, holding, processing or use of personal data which is, or is contained in, protected product or
relevant records. (Amended 18 of 2012 s. 2)
(2) Personal data which is, or is contained in, protected product or relevant records is exempt from the provisions of
this Ordinance. (Amended 18 of 2012 s. 2)
(3) In this section—
device retrieval warrant (器材取出手令) has the meaning assigned to it by section 2(1) of the Interception of
Communications and Surveillance Ordinance (Cap 589);
prescribed authorization (訂明授權 ) has the meaning assigned to it by section 2(1) of the Interception of
Communications and Surveillance Ordinance (Cap 589);
protected product (受保護成果 ) has the meaning assigned to it by section 2(1) of the Interception of
Communications and Surveillance Ordinance (Cap 589);
relevant records (有關紀錄) means documents and records relating to—
(a) any application for the issue or renewal of any prescribed authorization or device retrieval warrant under the
Interception of Communications and Surveillance Ordinance (Cap 589); or
(b) any prescribed authorization or device retrieval warrant issued or renewed under that Ordinance (including
anything done pursuant to or in relation to such prescribed authorization or device retrieval warrant).
(Added 20 of 2006 s. 68)
Section: 59 Health E.R. 1 of 2013 25/04/2013
(1) Personal data relating to the physical or mental health of the data subject is exempt from the provisions of either
or both of- (Amended 18 of 2012 s. 32)
(a) data protection principle 6 and section 18(1)(b);
(b) data protection principle 3,
in any case in which the application of those provisions to the data would be likely to cause serious harm to the
physical or mental health of-
(i) the data subject; or
(ii) any other individual.
(2) Personal data relating to the identity or location of a data subject is exempt from the provisions of data
protection principle 3 if the application of those provisions to the data would be likely to cause serious harm to
the physical or mental health of—
(a) the data subject; or
(b) any other individual. (Added 18 of 2012 s. 32)
(Enacted 1995)
Section: 59A Care and guardianship of minors 18 of 2012 01/10/2012
Personal data in relation to a minor transferred or disclosed by the Hong Kong Police Force or Customs and Excise
Department to a relevant person of the minor is exempt from the provisions of data protection principle 3 if—
(a) the purpose of the transfer or disclosure is to facilitate the relevant person to exercise proper care and
guardianship of the minor;
(b) the transfer or disclosure is in the interest of the minor; and
(c) the application of those provisions in relation to such transfer or disclosure would be likely to prejudice the
exercise of proper care and guardianship of the minor by the relevant person or the interest of the minor.
(Added 18 of 2012 s. 33)
Cap 486 - Personal Data (Privacy) Ordinance 44
Section: 60 Legal professional privilege E.R. 1 of 2013 25/04/2013
Personal data is exempt from the provisions of data protection principle 6 and section 18(1)(b) if the data consists of
information in respect of which a claim to legal professional privilege could be maintained in law.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 60A Self incrimination 18 of 2012 01/10/2012
(1) If, as a result of complying with a request under a provision of data protection principle 6 or section 18(1)(b) in
relation to any personal data, a data user might be incriminated in any proceedings for any offence other than an
offence under this Ordinance, the data is exempt from that provision or section.
(2) Information disclosed by a data user in compliance with a request under a provision of data protection principle
6 or section 18(1)(b) is not admissible against the data user in any proceedings for an offence under this
Ordinance.
(Added 18 of 2012 s. 34)
Section: 60B Legal proceedings etc. 18 of 2012 01/10/2012
Personal data is exempt from the provisions of data protection principle 3 if the use of the data is—
(a) required or authorized by or under any enactment, by any rule of law or by an order of a court in Hong
Kong;
(b) required in connection with any legal proceedings in Hong Kong; or
(c) required for establishing, exercising or defending legal rights in Hong Kong.
(Added 18 of 2012 s. 34)
Section: 61 News E.R. 1 of 2013 25/04/2013
(1) Personal data held by a data user-
(a) whose business, or part of whose business, consists of a news activity; and
(b) solely for the purpose of that activity (or any directly related activity),
is exempt from the provisions of- (Amended 18 of 2012 s. 2)
(i) data protection principle 6 and sections 18(1)(b) and 38(i) unless and until the data is published or broadcast
(wherever and by whatever means);
(ii) sections 36 and 38(b).
(2) Personal data is exempt from the provisions of data protection principle 3 in any case in which- (Amended 18 of
2012 s. 2)
(a) the use of the data consists of disclosing the data to a data user referred to in subsection (1); and
(b) such disclosure is made by a person who has reasonable grounds to believe (and reasonably believes) that
the publishing or broadcasting (wherever and by whatever means) of the data (and whether or not it is
published or broadcast) is in the public interest.
(3) In this section-
news activity (新聞活動) means any journalistic activity and includes-
(a) the-
(i) gathering of news;
(ii) preparation or compiling of articles or programmes concerning news; or
(iii) observations on news or current affairs,
for the purpose of dissemination to the public; or
(b) the dissemination to the public of-
(i) any article or programme of or concerning news; or
(ii) observations on news or current affairs.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Cap 486 - Personal Data (Privacy) Ordinance 45
Section: 62 Statistics and research E.R. 1 of 2013 25/04/2013
Personal data is exempt from the provisions of data protection principle 3 where- (Amended 18 of 2012 s. 2)
(a) the data is to be used for preparing statistics or carrying out research;
(b) the data is not to be used for any other purpose; and
(c) the resulting statistics or results of the research are not made available in a form which identifies the data
subjects or any of them.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 63 Exemption from section 18(1)(a) E.R. 1 of 2013 25/04/2013
Where a data access request relates to personal data which is or, if the data existed, would be exempt from section
18(1)(b) by virtue of section 57 or 58, then the data is also exempt from section 18(1)(a) if the interest protected by
that exemption would be likely to be prejudiced by the disclosure of the existence or non-existence of that data.
(Amended 18 of 2012 s. 2)
(Enacted 1995)
Section: 63A Human embryos, etc. E.R. 1 of 2013 25/04/2013
(1) Personal data which consists of information showing that an identifiable individual was, or may have been, born
in consequence of a reproductive technology procedure within the meaning of the Human Reproductive
Technology Ordinance (Cap 561) is exempt from the provisions of data protection principle 6 and section
18(1)(b) except so far as its disclosure under those provisions is made in accordance with section 33 of that
Ordinance.
(2) Where a data access request relates to personal data which is or, if the data existed, would be exempt from
section 18(1)(b) by virtue of subsection (1), then the data is also exempt from section 18(1)(a) if the interest
protected by that exemption would be likely to be prejudiced by the disclosure of the existence or non-existence
of the data.
(Added 47 of 2000 s. 48. Amended 18 of 2012 s. 2)
Section: 63B Due diligence exercise 18 of 2012 01/10/2012
(1) Personal data transferred or disclosed by a data user for the purpose of a due diligence exercise to be conducted
in connection with a proposed business transaction that involves—
(a) a transfer of the business or property of, or any shares in, the data user;
(b) a change in the shareholdings of the data user; or
(c) an amalgamation of the data user with another body,
is exempt from the provisions of data protection principle 3 if each of the conditions specified in subsection (2)
is satisfied.
(2) The conditions are—
(a) the personal data transferred or disclosed is not more than necessary for the purpose of the due diligence
exercise;
(b) goods, facilities or services which are the same as or similar to those provided by the data user to the data
subject are to be provided to the data subject, on completion of the proposed business transaction, by a party
to the transaction or a new body formed as a result of the transaction;
(c) it is not practicable to obtain the prescribed consent of the data subject for the transfer or disclosure.
(3) Subsection (1) does not apply if the primary purpose of the proposed business transaction is the transfer,
disclosure or provision for gain of the personal data.
(4) If a data user transfers or discloses personal data to a person for the purpose of a due diligence exercise to be
conducted in connection with a proposed business transaction described in subsection (1), the person—
(a) must only use the data for that purpose; and
(b) must, as soon as practicable after the completion of the due diligence exercise—
(i) return the personal data to the data user; and
Cap 486 - Personal Data (Privacy) Ordinance 46
(ii) destroy any record of the personal data that is kept by the person.
(5) A person who contravenes subsection (4) commits an offence and is liable on conviction to a fine at level 5 and
to imprisonment for 2 years.
(6) In this section—
due diligence exercise (盡職審查), in relation to a proposed business transaction, means the examination of the
subject matter of the transaction to enable a party to decide whether to proceed with the transaction;
provision for gain (為得益而提供), in relation to personal data, means provision of the data in return for money or
other property, irrespective of whether—
(a) the return is contingent on any condition; or
(b) the person who provides the data retains any control over the use of the data.
(Added 18 of 2012 s. 35)
Section: 63C Emergency situations 18 of 2012 01/10/2012
(1) Personal data is exempt from the provisions of data protection principle 1(3) and data protection principle 3 if
the application of those provisions to the data would be likely to prejudice any of the following matters—
(a) identifying an individual who is reasonably suspected to be, or is, involved in a life-threatening situation;
(b) informing the individual ’ s immediate family members or relevant persons of the individual ’ s
involvement in the life-threatening situation;
(c) the carrying out of emergency rescue operations or provision of emergency relief services.
(2) In this section—
immediate family member (家人), in relation to a person, means another person who is related to the person by blood,
marriage, adoption or affinity.
(Added 18 of 2012 s. 35)
Section: 63D Transfer of records to Government Records Service 18 of 2012 01/10/2012
Personal data contained in records that are transferred to the Government Records Service is exempt from the
provisions of data protection principle 3 when the records are used by the Government Records Service solely for the
purpose of—
(a) appraising the records to decide whether they are to be preserved; or
(b) organizing and preserving the records.
(Added 18 of 2012 s. 35)
Part: 9 Offences and Compensation E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 64 Offences for disclosing personal data obtained without
consent from data users
18 of 2012 01/10/2012
(1) A person commits an offence if the person discloses any personal data of a data subject which was obtained
from a data user without the data user’s consent, with an intent—
(a) to obtain gain in money or other property, whether for the benefit of the person or another person; or
(b) to cause loss in money or other property to the data subject.
(2) A person commits an offence if—
(a) the person discloses any personal data of a data subject which was obtained from a data user without the
data user’s consent; and
(b) the disclosure causes psychological harm to the data subject.
(3) A person who commits an offence under subsection (1) or (2) is liable on conviction to a fine of $1000000 and
to imprisonment for 5 years.
(4) In any proceedings for an offence under subsection (1) or (2), it is a defence for the person charged to prove that
Cap 486 - Personal Data (Privacy) Ordinance 47
—
(a) the person reasonably believed that the disclosure was necessary for the purpose of preventing or detecting
crime;
(b) the disclosure was required or authorized by or under any enactment, by any rule of law or by an order of a
court;
(c) the person reasonably believed that the data user had consented to the disclosure; or
(d) the person—
(i) disclosed the personal data for the purpose of a news activity as defined by section 61(3) or a directly
related activity; and
(ii) had reasonable grounds to believe that the publishing or broadcasting of the personal data was in the
public interest.
(Replaced 18 of 2012 s. 36)
(Enacted 1995)
Section: 64A Miscellaneous offences 18 of 2012 01/10/2012
(1) A data user who, without reasonable excuse, contravenes any requirement under this Ordinance commits an
offence and is liable on conviction to a fine at level 3.
(2) Subsection (1) does not apply in relation to—
(a) a contravention of a data protection principle;
(b) a contravention that constitutes an offence under section 14(11), 14A(6), (7) or (8), 15(4A) or (7), 18(5),
22(4), 31(4), 32(5), 44(10), 46(11), 50A(1) or (3), 50B(1), 63B(5) or 64(1) or (2); or
(c) a contravention of any requirement under Part VIA.
(Added 18 of 2012 s. 37)
Section: 64B Time limit for laying of information etc. 18 of 2012 01/10/2012
(1) Despite section 26 of the Magistrates Ordinance (Cap 227), a complaint or information in respect of an offence
under this Ordinance may be made to or laid before a magistrate within 2 years from the date of commission of
the offence.
(2) Subsection (1) does not apply in relation to the making of any complaint or laying of any information in respect
of an offence under this Ordinance which was committed before the *commencement date of section 37 of the
Personal Data (Privacy) (Amendment) Ordinance 2012 (18 of 2012).
(Added 18 of 2012 s. 37)
_____________________________________________________________________________
Note:
* Commencement date: 1 October 2012.
Section: 65 Liability of employers and principals E.R. 1 of 2013 25/04/2013
(1) Any act done or practice engaged in by a person in the course of his employment shall be treated for the
purposes of this Ordinance as done or engaged in by his employer as well as by him, whether or not it was done
or engaged in with the employer's knowledge or approval.
(2) Any act done or practice engaged in by a person as agent for another person with the authority (whether express
or implied, and whether precedent or subsequent) of that other person shall be treated for the purposes of this
Ordinance as done or engaged in by that other person as well as by him.
(3) In proceedings brought under this Ordinance against any person in respect of an act or practice alleged to have
been done or engaged in, as the case may be, by an employee of his it shall be a defence for that person to prove
that he took such steps as were practicable to prevent the employee from doing that act or engaging in that
practice, or from doing or engaging in, in the course of his employment, acts or practices, as the case may be, of
that description.
(4) For the avoidance of doubt, it is hereby declared that this section shall not apply for the purposes of any criminal
proceedings.
(Enacted 1995)
Cap 486 - Personal Data (Privacy) Ordinance 48
Section: 66 Compensation E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (4), an individual who suffers damage by reason of a contravention-
(a) of a requirement under this Ordinance;
(b) by a data user; and
(c) which relates, whether in whole or in part, to personal data of which that individual is the data subject,
shall be entitled to compensation from that data user for that damage.
(2) For the avoidance of doubt, it is hereby declared that damage referred to in subsection (1) may be or include
injury to feelings.
(3) In any proceedings brought against any person by virtue of this section it shall be a defence to show that-
(a) he had taken such care as in all the circumstances was reasonably required to avoid the contravention
concerned; or
(b) in any case where the contravention concerned occurred because the personal data concerned was
inaccurate, the data accurately record data received or obtained by the data user concerned from the data
subject or a third party. (Amended 18 of 2012 s. 38)
(4) Where an individual suffers damage referred to in subsection (1) by reason of a contravention referred to in that
subsection which occurred because the personal data concerned was inaccurate, then no compensation shall be
payable under that subsection in respect of so much of that damage that has occurred at any time before the
expiration of 1 year immediately following the day on which this section commences. (Amended 18 of 2012 s.
38)
(5) Proceedings brought by an individual in reliance on subsection (1) are to be brought in the District Court but all
such remedies are obtainable in those proceedings as would be obtainable in the Court of First Instance. (Added
18 of 2012 s. 38)
(Enacted 1995)
Section: 66A Help for aggrieved persons in obtaining information, etc. L.N. 5 of 2013 01/04/2013
(1) With a view to helping a person (the person aggrieved) to decide whether to institute proceedings under section
66 and, if the person does so, to formulate and present his or her case in the most effective manner, the
Commissioner may prescribe—
(a) forms by which the person aggrieved may question the respondent on the respondent’s reasons for doing
any relevant act, or on any other matter which is or may be relevant; and
(b) forms by which the respondent may, if he or she so wishes, reply to any questions.
(2) If the person aggrieved questions the respondent (whether or not in accordance with a form referred to in
subsection (1))—
(a) the question and any reply by the respondent (whether or not in accordance with such a form) are, subject to
subsections (3), (4) and (5), admissible as evidence in the proceedings; and
(b) if it appears to the District Court that the respondent, deliberately and without reasonable excuse, omitted to
reply within a reasonable period or that the respondent’s reply is evasive or equivocal, the Court may
draw any inference from that fact it considers just and equitable to draw.
(3) The Commissioner may—
(a) prescribe the period within which questions must be served in order to be admissible under subsection
(2)(a); and
(b) prescribe the manner in which a question and any reply by the respondent may be served.
(4) Rules under the District Court Ordinance (Cap 336) may empower the District Court entertaining a claim under
section 66 to determine, before the date fixed for the hearing of the claim, whether a question or reply is
admissible under this section or not.
(5) This section is without prejudice to any other enactment or rule of law regulating interlocutory and preliminary
matters in proceedings before the District Court, and has effect subject to any enactment or rule of law
regulating the admissibility of evidence in such proceedings.
(6) In this section—
respondent (答辯人) includes a prospective respondent.
(Added 18 of 2012 s. 39)
Cap 486 - Personal Data (Privacy) Ordinance 49
Section: 66B Commissioner may grant assistance in respect of
proceedings
L.N. 5 of 2013 01/04/2013
(1) A person who may institute proceedings to seek compensation under section 66 may make an application to the
Commissioner for assistance in respect of those proceedings.
(2) The Commissioner must consider an application under subsection (1) and may grant it if the Commissioner
thinks fit to do so, in particular if—
(a) the case raises a question of principle; or
(b) it is unreasonable, having regard to the complexity of the case or the applicant’s position in relation to the
respondent or another person involved or any other matter, to expect the applicant to deal with the case
unaided.
(3) Assistance by the Commissioner under this section may include—
(a) giving advice;
(b) arranging for the giving of advice or assistance by a solicitor or counsel;
(c) arranging for representation by any person, including all such assistance as is usually given by a solicitor or
counsel in the steps preliminary or incidental to any proceedings, or in arriving at or giving effect to a
compromise to avoid or bring to an end any proceedings; and
(d) any other form of assistance which the Commissioner may consider appropriate.
(4) Subsection (3)(c) does not affect the law and practice regulating the descriptions of persons who may appear in,
conduct, defend and address a court in, any proceedings except to the extent permitted under rules made in
accordance with section 73F of the District Court Ordinance (Cap 336).
(5) If expenses are incurred by the Commissioner in providing the applicant with assistance under this section, the
recovery of those expenses (as taxed or assessed in such manner as may be prescribed by relevant rules)
constitutes a first charge for the benefit of the Commissioner—
(a) on any costs or expenses which are payable to the applicant by any other person (whether by virtue of a
judgment or order of the District Court or an agreement or otherwise) in respect of the matter in connection
with which the assistance is given; and
(b) on the applicant’s rights (so far as those rights relate to any costs or expenses) under any compromise or
settlement arrived at in connection with that matter to avoid or bring to an end any proceedings.
(6) The charge created by subsection (5) is subject to any charge under the Legal Aid Ordinance (Cap 91) and to any
provision in that Ordinance for payment of any sum into the Supplementary Legal Aid Fund established under
that Ordinance.
(7) In this section—
relevant rules (《法院規則》) means any rules made under the District Court Ordinance (Cap 336);
respondent (答辯人) includes a prospective respondent.
(Added 18 of 2012 s. 39)
Part: 10 Miscellaneous E.R. 1 of 2013 25/04/2013
(Enacted 1995)
Section: 67 Power of Commissioner to specify forms E.R. 1 of 2013 25/04/2013
(1) Subject to subsection (2), the Commissioner may specify the form of any document required under this
Ordinance to be in the specified form and the form of such other documents required for the purposes of this
Ordinance as he thinks fit.
(2) The Commissioner's power under subsection (1) shall be subject to any express requirement under this
Ordinance for a form, whether specified or otherwise, to comply with that requirement, but that requirement
shall not restrict the exercise of that power in respect of that form to the extent that, in the opinion of the
Commissioner, his exercise of that power in respect of that form does not contravene that requirement.
(3) The Commissioner's power under subsection (1) may be exercised in such a way as to-
(a) include in the specified form of any document referred to in that subsection a statutory declaration-
Cap 486 - Personal Data (Privacy) Ordinance 50
(i) to be made by the person completing the form; and
(ii) as to whether the particulars contained in the form are true and correct to the best of that person's
knowledge and belief;
(b) specify 2 or more forms of any document referred to in that subsection, whether as alternatives, or to
provide for particular circumstances or particular cases, as the Commissioner thinks fit.
(4) A form specified under this section shall be-
(a) completed in accordance with such directions and instructions as are specified in the form;
(b) accompanied by such documents as are specified in the form; and
(c) if the completed form is required to be provided to-
(i) the Commissioner;
(ii) another person on behalf of the Commissioner; or
(iii) any other person,
so provided in the manner, if any, specified in the form.
(Enacted 1995)
Section: 68 Service of notices E.R. 1 of 2013 25/04/2013
A notice (howsoever described) which is required to be served under this Ordinance, or which may be served under
this Ordinance, on a person (howsoever described) shall, in the absence of evidence to the contrary, be deemed to be
so served if-
(a) in the case of an individual, it is-
(i) delivered to him;
(ii) left at his last known address for service, or at his last known place of residence or business, in Hong
Kong;
(iii) sent by post to him at his last known address for service, or at his last known postal address, in Hong
Kong; or
(iv) sent by telex, facsimile transmission or other similar method to him at his last known address for
service, or at his last known postal address, or at his last known place of residence or business, in Hong
Kong;
(b) in the case of a company, it is-
(i) given to or served on an officer of the company;
(ii) left at the company's last known address for service, or at its last known place of business, in Hong
Kong;
(iii) sent by post to the company at its last known address for service, or at its last known postal address, in
Hong Kong; or
(iv) sent by telex, facsimile transmission or other similar method to the company at its last known address
for service, or at its last known postal address, or at its last known place of business, in Hong Kong;
(c) in the case of a partnership, it is-
(i) delivered, left or sent in accordance with paragraph (a) in respect of any partner who is an individual;
or
(ii) given, served, left or sent in accordance with paragraph (b) in respect of any partner which is a
company;
(d) in the case of a person (attorney) holding a power of attorney under which the attorney is authorized to
accept service in respect of another person, it is-
(i) delivered, left or sent in accordance with paragraph (a) where the attorney is an individual;
(ii) given, served, left or sent in accordance with paragraph (b) where the attorney is a company;
(iii) delivered, left or sent in accordance with paragraph (a) in respect of any partner who is an individual
where the attorney is a partnership; or
(iv) given, served, left or sent in accordance with paragraph (b) in respect of any partner which is a
company where the attorney is a partnership.
(Enacted 1995)
Section: 69 Regulations - fees E.R. 1 of 2013 25/04/2013
(1) The Commissioner may make regulations to prescribe the fees to be paid in respect of any matter, service or
Cap 486 - Personal Data (Privacy) Ordinance 51
facility in respect of which a prescribed fee is payable to the Commissioner under this Ordinance.
(2) The amount of any fee prescribed in regulations made under subsection (1) shall not be limited by reference to
the amount of administrative or other costs incurred or likely to be incurred in relation to providing the matter,
service or facility to which such fee relates, and different fees may be so prescribed for the same matter, service
or facility in order to provide for particular circumstances or particular cases specified in the regulations.
(Enacted 1995)
Section: 70 Regulations - general E.R. 1 of 2013 25/04/2013
Remarks:
For the saving and transitional provisions relating to the amendments made by the Resolution of the Legislative
Council (L.N. 130 of 2007), see paragraph (12) of that Resolution.
(1) The Secretary for Constitutional and Mainland Affairs may make regulations for all or any of the following
matters- (Amended L.N. 130 of 2007)
(a) the particulars to be entered in the log book of a data user, including particulars referred to in section
27(2)(a), (b) and (c);
(b) prescribing anything that is required or permitted to be prescribed under this Ordinance.
(2) Any regulations made under this section may-
(a) empower the Commissioner to grant exemptions from the regulations, either generally or in a particular
case;
(b) make different provisions for different circumstances and provide for a particular case or class of case;
(c) be made so as to apply only in such circumstances as are prescribed by the regulations.
(3) Any regulations made under this section may prescribe offences in respect of contraventions of the regulations,
and may provide for the imposition in respect of any such offence of a fine not exceeding level 3 and of
imprisonment for a period not exceeding 2 years and, in the case of a continuing offence, to a daily penalty not
exceeding $1000.
(Enacted 1995)
Section: 71 Amendment of Schedules 2, 4 and 6 E.R. 1 of 2013 25/04/2013
The Chief Executive in Council may, by notice in the Gazette, amend Schedule 2, 4 or 6.
(Amended 34 of 1999 s. 3)
(Enacted 1995)
Section: 72 (Omitted as spent—E.R. 1 of 2013) E.R. 1 of 2013 25/04/2013
Section: 73 (Omitted as spent—E.R. 1 of 2013) E.R. 1 of 2013 25/04/2013
Schedule: 1 Data Protection Principles E.R. 1 of 2013 25/04/2013
[sections 2(1) & (6)]
1. Principle 1-purpose and manner of
collection of personal data
(1) Personal data shall not be collected unless-
(a) the data is collected for a lawful purpose directly related to a function or activity of the data user who
is to use the data;
(b) subject to paragraph (c), the collection of the data is necessary for or directly related to that purpose;
and
Cap 486 - Personal Data (Privacy) Ordinance 52
(c) the data is adequate but not excessive in relation to that purpose.
(2) Personal data shall be collected by means which are-
(a) lawful; and
(b) fair in the circumstances of the case.
(3) Where the person from whom personal data is or is to be collected is the data subject, all practicable steps
shall be taken to ensure that- (Amended 18 of 2012 s. 40)
(a) he is explicitly or implicitly informed, on or before collecting the data, of-
(i) whether it is obligatory or voluntary for him to supply the data; and
(ii) where it is obligatory for him to supply the data, the consequences for him if he fails to supply
the data; and
(b) he is explicitly informed-
(i) on or before collecting the data, of-
(A) the purpose (in general or specific terms) for which the data is to be used; and
(B) the classes of persons to whom the data may be transferred; and
(ii) on or before first use of the data for the purpose for which it was collected, of- (Amended 18 of
2012 s. 40)
(A) his rights to request access to and to request the correction of the data; and
(B) the name or job title, and address, of the individual who is to handle any such request made
to the data user, (Replaced 18 of 2012 s. 40)
unless to comply with the provisions of this subsection would be likely to prejudice the purpose for which
the data was collected and that purpose is specified in Part VIII of this Ordinance as a purpose in relation to
which personal data is exempt from the provisions of data protection principle 6.
(Amended 18 of 2012 s. 40)
2. Principle 2-accuracy and duration of retention of personal data
(1) All practicable steps shall be taken to ensure that-
(a) personal data is accurate having regard to the purpose (including any directly related purpose) for
which the personal data is or is to be used;
(b) where there are reasonable grounds for believing that personal data is inaccurate having regard to the
purpose (including any directly related purpose) for which the data is or is to be used- (Amended 18 of
2012 s. 40)
(i) the data is not used for that purpose unless and until those grounds cease to be applicable to the
data, whether by the rectification of the data or otherwise; or
(ii) the data is erased;
(c) where it is practicable in all the circumstances of the case to know that-
(i) personal data disclosed on or after the appointed day to a third party is materially inaccurate
having regard to the purpose (including any directly related purpose) for which the data is or is to
be used by the third party; and
(ii) that data was inaccurate at the time of such disclosure,
that the third party-
(A) is informed that the data is inaccurate; and
(B) is provided with such particulars as will enable the third party to rectify the data having regard to
that purpose. (Amended 18 of 2012 s. 40)
(2) All practicable steps must be taken to ensure that personal data is not kept longer than is necessary for the
fulfillment of the purpose (including any directly related purpose) for which the data is or is to be used.
(Amended 18 of 2012 s. 40)
(3) Without limiting subsection (2), if a data user engages a data processor, whether within or outside Hong
Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other
means to prevent any personal data transferred to the data processor from being kept longer than is
necessary for processing of the data. (Added 18 of 2012 s. 40)
(4) In subsection (3)—
data processor (資料處理者) means a person who—
Cap 486 - Personal Data (Privacy) Ordinance 53
(a) processes personal data on behalf of another person; and
(b) does not process the data for any of the person’s own purposes. (Added 18 of 2012 s. 40)
(Amended 18 of 2012 s. 40)
3. Principle 3-use of personal data
(1) Personal data shall not, without the prescribed consent of the data subject, be used for a new purpose.
(Amended 18 of 2012 s. 40)
(2) A relevant person in relation to a data subject may, on his or her behalf, give the prescribed consent
required for using his or her personal data for a new purpose if—
(a) the data subject is—
(i) a minor;
(ii) incapable of managing his or her own affairs; or
(iii) mentally incapacitated within the meaning of section 2 of the Mental Health Ordinance (Cap
136);
(b) the data subject is incapable of understanding the new purpose and deciding whether to give the
prescribed consent; and
(c) the relevant person has reasonable grounds for believing that the use of the data for the new purpose is
clearly in the interest of the data subject. (Added 18 of 2012 s. 40)
(3) A data user must not use the personal data of a data subject for a new purpose even if the prescribed consent
for so using that data has been given under subsection (2) by a relevant person, unless the data user has
reasonable grounds for believing that the use of that data for the new purpose is clearly in the interest of the
data subject. (Added 18 of 2012 s. 40)
(4) In this section—
new purpose (新目的), in relation to the use of personal data, means any purpose other than—
(a) the purpose for which the data was to be used at the time of the collection of the data; or
(b) a purpose directly related to the purpose referred to in paragraph (a). (Added 18 of 2012 s. 40)
4. Principle 4-security of personal data
(1) All practicable steps shall be taken to ensure that personal data (including data in a form in which access to
or processing of the data is not practicable) held by a data user are protected against unauthorized or
accidental access, processing, erasure, loss or use having particular regard to- (Amended 18 of 2012 s. 40)
(a) the kind of data and the harm that could result if any of those things should occur;
(b) the physical location where the data is stored; (Amended 18 of 2012 s. 40)
(c) any security measures incorporated (whether by automated means or otherwise) into any equipment in
which the data is stored; (Amended 18 of 2012 s. 40)
(d) any measures taken for ensuring the integrity, prudence and competence of persons having access to
the data; and
(e) any measures taken for ensuring the secure transmission of the data.
(2) Without limiting subsection (1), if a data user engages a data processor, whether within or outside Hong
Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other
means to prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred
to the data processor for processing. (Added 18 of 2012 s. 40)
(3) In subsection (2)—
data processor (資料處理者) has the same meaning given by subsection (4) of data protection principle 2.
(Added 18 of 2012 s. 40)
5. Principle 5-information to be generally available
All practicable steps shall be taken to ensure that a person can-
(a) ascertain a data user's policies and practices in relation to personal data;
Cap 486 - Personal Data (Privacy) Ordinance 54
(b) be informed of the kind of personal data held by a data user;
(c) be informed of the main purposes for which personal data held by a data user is or is to be used.
(Amended 18 of 2012 s. 40)
6. Principle 6-access to personal data
A data subject shall be entitled to-
(a) ascertain whether a data user holds personal data of which he is the data subject;
(b) request access to personal data-
(i) within a reasonable time;
(ii) at a fee, if any, that is not excessive;
(iii) in a reasonable manner; and
(iv) in a form that is intelligible;
(c) be given reasons if a request referred to in paragraph (b) is refused;
(d) object to a refusal referred to in paragraph (c);
(e) request the correction of personal data;
(f) be given reasons if a request referred to in paragraph (e) is refused; and
(g) object to a refusal referred to in paragraph (f).
(Enacted 1995)
Schedule: 2 Finances, ETC. of Commissioner E.R. 1 of 2013 25/04/2013
Remarks:
For the saving and transitional provisions relating to the amendments made by the Resolution of the Legislative
Council (L.N. 130 of 2007), see paragraph (12) of that Resolution.
[sections 5(7), 10(2)(c)
& 71]
1. Resources of Commissioner
(1) The resources of the Commissioner shall consist of-
(a) all money-
(i) paid by the Government to the Commissioner and appropriated for that purpose by the
Legislative Council; and
(ii) otherwise provided to the Commissioner by the Government; and
(b) all other money and property, including gifts, donations, fees, rent, interest and accumulations of
income received by the Commissioner.
(2) The Secretary for Financial Services and the Treasury may give directions in writing of a general or specific
character to the Commissioner in relation to the amount of money which may be expended by the
Commissioner in any financial year and the Commissioner shall comply with those directions. (Amended
L.N. 106 of 2002)
(3) For the avoidance of doubt, it is hereby declared that any remuneration or other benefit payable to, and any
expenses of-
(a) the Commissioner; or
(b) any person employed or engaged under section 9(1) of this Ordinance,
shall be paid out of the resources of the Commissioner.
2. Borrowing powers
(1) Subject to subsection (2), the Commissioner may borrow by way of overdraft such money as he may
require for meeting his obligations or performing his functions under this Ordinance.
(2) The Secretary for Constitutional and Mainland Affairs may, after consulting with the Secretary for
Financial Services and the Treasury, give directions in writing of a general or specific character to the
Cap 486 - Personal Data (Privacy) Ordinance 55
Commissioner in relation to the amount of money which may be borrowed under subsection (1) and the
Commissioner shall comply with those directions.
(3) The Commissioner may with the approval of the Secretary for Constitutional and Mainland Affairs given
after the Secretary has consulted with the Secretary for Financial Services and the Treasury borrow,
otherwise than by way of overdraft, such money as he may require for meeting his obligations or
performing his functions under this Ordinance.
(4) A person lending money to the Commissioner shall not be concerned to inquire whether the borrowing of
the money is legal or regular or whether the money raised has been properly applied and shall not be
prejudiced by any illegality or irregularity or by misapplication or non-application of the money.
(Amended L.N. 106 of 2002; L.N. 130 of 2007)
3. Investment of surplus funds
(1) Subject to subsection (2), the Commissioner may invest money that is not immediately required to be
expended.
(2) The Commissioner shall not invest money pursuant to subsection (1) except in such forms of investment as
the Secretary for Constitutional and Mainland Affairs, after consulting with the Secretary for Financial
Services and the Treasury, approves. (Amended L.N. 106 of 2002; L.N. 130 of 2007)
(3) Subsection (1) shall not be subject to section 10(1) of this Ordinance.
4. Accounts, audit and annual report of Commissioner
(1) The Commissioner shall cause proper accounts to be kept of all his financial transactions.
(2) The Commissioner shall, as soon as practicable after the expiry of a financial year, prepare a statement of
the accounts of the Commissioner, which statement shall include an income and expenditure account and a
balance sheet.
(3) The Commissioner shall appoint an auditor who shall, as soon as practicable, audit the accounts required
under subsection (1) and the statement of accounts required under subsection (2) and shall submit a report
on the statement to the Commissioner.
(4) The Commissioner shall, as soon as practicable and in any case not later than 9 months after the expiry of a
financial year (or such further period as the Chief Secretary for Administration allows), furnish-
(a) a report on the activities of the Commissioner during that year including a general survey of
developments, during that year, in respect of matters falling within the scope of the Commissioner's
functions;
(b) a copy of the statement of accounts required under subsection (2); and
(c) the auditor's report on the statement,
to the Chief Secretary for Administration who shall cause the same to be tabled in the Legislative Council.
(Amended L.N. 362 of 1997)
(5) This section shall not be subject to section 10(1) of this Ordinance.
5. Director of Audit's examination
(1) The Director of Audit may, in respect of any financial year, conduct an examination into the economy,
efficiency and effectiveness with which the Commissioner has expended his resources in performing his
functions and exercising his powers.
(2) Subject to subsection (3), the Director of Audit shall have a right of access at all reasonable times to all such
documents as he may reasonably require for conducting an examination under this section and shall be
entitled to require from any person holding or being accountable for any such document such information
and explanation as he considers reasonably necessary for that purpose.
(3) Subsection (2) applies only to documents in the custody and control of the Commissioner.
(4) The Director of Audit may report to the President of the Legislative Council the results of an examination
conducted by him under this section.
Cap 486 - Personal Data (Privacy) Ordinance 56
(5) Subsection (1) shall not operate to entitle the Director of Audit to question the merits of the policy
objectives of the Commissioner.
6. Exemption from taxation
(1) The Commissioner shall be exempt from taxation under the Inland Revenue Ordinance (Cap 112).
(2) For the avoidance of doubt, it is hereby declared that subsection (1) does not apply to or in relation to any
remuneration, benefits or expenses referred to in section 1(3) paid out of the resources of the Commissioner
to the Commissioner.
(Enacted 1995)
Schedule: 3 Precribed Information E.R. 1 of 2013 25/04/2013
[section 2]
(Amended 18 of 2012 s. 41)
1. The name and address of the data user.
2. A description of the kind of personal data in respect of which the data user is a data user.
3. A description of the purpose or purposes for which the personal data referred to in item 2 is or is to be collected,
held, processed or used by the data user. (Amended 18 of 2012 s. 41)
4. A description of any classes of persons to whom the data user discloses, intends to disclose or may wish to
disclose the personal data referred to in item 2.
5. The names or a description of any places outside Hong Kong to which the data user transfers, intends to transfer
or may wish to transfer, the personal data referred to in item 2.
6. The name or job title, and address, of the individual who is to handle data access requests made to the data user.
(Replaced 18 of 2012 s. 41)
(Enacted 1995)
Schedule: 4 Provisions of Ordinance under which Matching
Procedures are Required or Permitted
E.R. 1 of 2013 25/04/2013
[sections 30(1)(d) & 71]
(Enacted 1995)
Schedule: 5 Prescribed Matters E.R. 1 of 2013 25/04/2013
[section 32(4)]
1. Whether the carrying out of the matching procedure is in the public interest.
2. The kind of personal data to be the subject of the matching procedure.
3. The likely consequences to a data subject if the matching procedure were to result in any adverse action taken
against the data subject.
4. The practices and procedures, if any, that will be followed to enable a data subject to make a data correction
request-
(a) in respect of the personal data produced or verified by the matching procedure; (Amended 18 of 2012
Cap 486 - Personal Data (Privacy) Ordinance 57
s. 42)
(b) before any adverse action is taken against the data subject.
5. The practices and procedures, if any, that will be followed to ensure, so far as is practicable, the accuracy of any
personal data produced or verified by the matching procedure.
6. Whether any such data subject is to be informed of the procedure before it is first carried out.
7. Whether there is any practicable alternative to the matching procedure.
8. The benefits to be derived from carrying out the matching procedure.
(Enacted 1995)
Schedule: 6 E.R. 1 of 2013 25/04/2013
[sections 42(6), (7) & (11) & 71]
PART 1
Warrant Authorizing Privacy Commissioner for Personal Data to Enter Specified Premises without Informing
Relevant Data User
To the Privacy Commissioner for Personal Data.
Having been satisfied by information upon oath/declaration* that there are reasonable grounds for believing that
the purposes of an investigation under the Personal Data (Privacy) Ordinance (Cap 486) in relation
to ............................................................................ [name of relevant data user] may be substantially prejudiced if you
were required to comply with section 42(3) of that Ordinance before exercising your power under section 42(2) of that
Ordinance in respect of the premises
at ...................................................................................................... ...................................................................................
.......................................................... [address of premises occupied by the relevant data user/in which is situated the
personal data system, or any part thereof, used by the relevant data user*]:
YOU ARE HEREBY AUTHORIZED, with such assistants as may be necessary, to exercise your power under
section 42(2) of that Ordinance in respect of those premises without complying with section 42(3) of that Ordinance
provided that such power is exercised before the expiration of 14 days after the date on which this warrant is issued.
Dated this ........... day of ...................... 19 ......
......................................
(Signature) Magistrate
* Delete whichever is inapplicable.
PART 2
Warrant Authorizing Privacy Commissioner for Personal Data to Enter Specified Domestic Premises
To the Privacy Commissioner for Personal Data.
Having been satisfied by information upon oath/declaration* that there are reasonable grounds for believing that
the purposes of the investigation into ................................... [name of relevant data user] may be substantially
prejudiced if you are prevented by the operation of section 42(4) of the Personal Data (Privacy) Ordinance (Cap 486)
Cap 486 - Personal Data (Privacy) Ordinance 58
from exercising your power under section 42(2) of that Ordinance in respect of the domestic premises
at ............................. ............................................................................................................................................. [address
of domestic premises occupied by the relevant data user/in which is situated the personal data system, or any part
thereof, used by the relevant data user*]:
YOU ARE HEREBY AUTHORIZED, with such assistants as may be necessary, to exercise that power in
respect of those premises provided that such power is exercised before the expiration of 14 days after the date on
which this warrant is issued.
Dated this ........... day of ......................... 19 .......
......................................
(Signature) Magistrate
* Delete whichever is inapplicable.
(Enacted 1995)
