Personal Data (Privacy) Ordinance

I am writing to draw your attention to the Personal Data (Privacy) Ordinance ("the Ordinance") which was enacted on 3 August 1995 and gazetted on 4 August 1995. The Ordinance is expected to commence in mid-1996, pending the appointment of a Privacy Commissioner who will be responsible for monitoring and supervision of compliance with the Ordinance.

The main objective of the Ordinance is to protect privacy with respect to personal data based on internationally recognised data protection principles. These principles provide for the fair collection, use, holding and disclosure of personal data, and for the subject of personal data to have rights of access and correction. The basic features of the Ordinance and the Data Protection Principles as set out in Schedule 1 of the Ordinance are summarised at Annexes 1 and 2 respectively. These summaries do not constitute a legal interpretation of the provisions of the Ordinance, for which appropriate legal advice should be sought where necessary.

It should be noted that section 4 of the Ordinance makes it an offence if a data user does an act, or engages in a practice, that contravenes a data protection principle unless the act or practice is required or permitted under the Ordinance.

In the light of the enactment of the Ordinance, authorized institutions should take steps to review and revise, if necessary, their policies and practices in respect of the collection, use, holding and disclosure of the personal data of customers. It is imperative to ensure that such internal policies and practices will at all times comply with the provisions of the Ordinance upon its commencement. You may wish to seek your own legal advice on the practical implications of the Ordinance on your institution's business operations.

As you are aware, the HKMA and the industry Associations have formed a Working Group to develop a Code of Banking Practice in Hong. Kong. Since the Ordinance will have significant bearing on the relationship between banks and customers, the relevant provisions of the legislation will be taken into account by the Working Group in formulating recommendations relating to the processing of customer information and the duty of confidentiality.

Yours faithfully,

(D T R Carse)
Deputy Chief Executive (Banking)

Encl

c.c. Secretary for Financial Services
Secretary for Home Affairs

Annex 1

Basic features of the Personal Data Privacy Ordinance

(a) Section 4 provides that an act or practice that contravenes a data protection principle (in Schedule 1) shall be unlawful unless it is required and permitted by the Ordinance.

(b) Part II provides for the establishment of the office of the Privacy Commissioner and sets out his appointment, functions and powers.

(c) Part III provides for the Privacy Commissioner to approve and issue codes of practice giving guidance on compliance with the Ordinance.

(d) Part IV requires data users belonging to a class of data users specified by notice in the Gazette to submit an annual return in the specified form.

(e) Part V provides for a data subject, or a relevant person acting on his behalf, to ascertain whether a data user has personal data relating to him and to be provided with a copy of any such data. The data user is required to comply with a request subject to certain specified exceptions. There are also similar provisions with respect to the seeking of a correction of personal data.

(f) Part IV prohibits a data user from carrying out a matching procedure unless it is required or permitted by another Ordinance, and the data subjects concerned have given consent or it is authorised by the Privacy Commissioner. The data user is also prohibited from transferring personal data outside Hong Kong to a place that does not have in force any law with similar effect to the Ordinance unless, inter alia, the data subjects have given consent or reasonable precautions are taken to ensure that the data is afforded appropriate protection. Data users who use personal data for direct marketing are also required to inform the data subjects concerned that they may request the erasure of such data.

(g) Part VII sets out the powers of the Privacy Commissioner to investigate into complaints concerning acts of data users that may be in contravention of the Ordinance It also provides for the powers of

inspection of the Commissioner, his power to publish a report, and the appeal channels.

(h) Part VIII provides for a number of exemptions from certain provisions of the Ordinance. These include, among others, personal data held for -

(i) domestic purposes;

(ii) certain employment related purposes;

(iii) the purposes of safeguarding security, defence and international relations;

(iv) a variety of public interest purposes, including the prevention or detection of crime, the apprehension, prosecution or detention of offenders, the assessment or collection of any tax or duty, and financial services regulation;

(v) purposes relating to the physical or mental health of the data subject, where the application of the provisions would cause serious harm to the health of the data subject or any other individual;

(vi) purposes for which a claim to legal professional privilege could be maintained;

(vii) news activity; and

(viii) preparing statistics or carrying out research.

(i) Part IX provides for offences and compensation in relation to the contravention of the Ordinance.

(j) Part X provides for the powers of the Secretary for Home Affairs to make regulations for the purposes for the Ordinance.

Annex 2

Summary of Data Protection Principles

Principle 1- purpose and manner of collection of personal data

Fair collection of personal data, including a requirement that a data subject be informed of the purposes for which the data are collected from him.

Principle 2 - accuracy and duration of retention of personal data

All practicable steps to be taken to ensure the accuracy of personal data.

Principle 3 - use of personal data

The use of personal data shall be limited to the purposes, or directly related purposes, for which they were collected or for which the data subject has given consent.