WORLD TRADE ORGANIZATION 
ORGANISATION MONDIALE DU COMMERCE 
ORGANIZACION MUNDIAL DEL COMERCIO 
Council for Trade-Related Aspects of 
Intellectual Property Rights IPINIl/HKG/u1l 
20 March 2000 
(00-1141) 
Original: English! 
anglaisl 
ingles 
MAIN DEDICATED INTELLECTUAL PROPERTY 
LAWS AND REGULATIONS NOTIFIED UNDER 
ARTICLE 63.2 OF THE AGREEMENT 
HONG KONG, CHINA 
The present document reproduces the textl of the Personal Data (Privacy) Ordinance, as 
notified by Hong Kong, China under Article 63.2 ofthe Agreement (see document IPINIIIHKG/2). 
Conseil des aspects des droits de propriete 
intellectuelle qui touchent au commerce 
PRlNCIPALES LOIS ET REGLEMENTATIONS CONSACREES A LA 
PROPRIErE INTELLECTUELLE NOTIFIEES AU TITRE 
DE L'ARTICLE 63:2 DE L'ACCORD 
HONG KONG, CHINE 
Le present document contient le textel de l'Ordonnance sur les donnees a caracU:re personnel 
(protection de la vie privee), notifiee par Hong Kong, Chine au titre de l'article 63:2 de l'Accord (voir 
le document IPINIlIHKG/2). 
Consejo de los Aspectos de los Derechos de Propiedad 
Intelectual relacionados con el Comercio 
PRlNCIPALES LEYES Y REGLAMENTOS DEDICADOS A LA PROPIEDAD 
INTELECTUAL NOTIFICADOS EN VIRTUD DEL P ARRAFO 2 
DEL ARTicULO 63 DEL ACUERDO 
HONG KONG, CHINA 
En el presente documento se reproduce el textol de la Orden sobre los Datos de Canicter 
Personal (intimidad de los particulares) notificado por Hong Kong, China en virtud del parrafo 2 del 
articulo 63 del Acuerdo (vease el documento IPINIIIHKG/2). 
I In English only.lEn anglais seulement.lEn ingles solamente. IP/N/lIHKGIUIl 
Page 2 
486 Title: 
Heading: PBRSONALDATA 
(PRIVACY)0RDlN,,\NCB 
Long title Gazette: Number: 
Version Date: 30/0611997 
An Ordinance to protect the privacy of individuals in relation to personal data, and to provide for matters 
incidental thereto or connected therewith. 
[Part II, section 71 (as affects 
Schedule 2) and Schedule 2 
The other provisions, 
excluding sections 30 and 33 
Section 30 
(Originally 81 of 1995) (Enacted 1995) 
} 1 August 1996 L.N. 343 of 1996 
} 
} 20 December 1996 L.N. 514 of 1996 
1 August 1997 L.N. 409 of 1997] Chapter: 486 ThIe: 
I Heading: PBRSONAL DATA 
(f'RJVACY)OROlNANCE 
.. Short title.alJo 
commencement 
PART I 
PRELIMINARY IP /NI IIHKG/U /1 
Page 3 
Gazette Numbet: 
Version Date: 30106!1997 
(1) This Ordinance may be cited as the Personal Data (Privacy) Ordinance. 
(2) This Ordinance shall come into operation on a day to be appointed by the Secretary for Home 
Affairs by notice in the Gazette. 
(Enacted 1995) IP/N/1/HKG/u/1 
Page 4 
Chapter: 4&6 
Section: 2 Title: PERSONAtDATA 
(PRJVA('Y)ORDlNANCE 
Heading: Interpretation 
(1) In this Ordinance, unless the context otherwise requires­
"act" includes a deliberate omission; Gazette Number: L.N.70of 
1999 
Version Date: 03/0811999 
"adverse action", in relation to an individual, means any action that may adversely affect the 
individual's rights, benefits, privileges, obligations or interests (including legitimate expectations); 
"appointed day" means the day appointed under section 1(2); 
"approved code of practice" means a code of practice approved under section 12; 
"code of practice" includes-
(a) a standard; 
(b) a specification; and 
(c) any other documentary form of practical guidance; 
"Commissioner" means the Privacy Commissioner for Personal Data established under section 5(1); 
"Committee" means the Personal Data (Privacy) Advisory Committee established under 
section 11(1); 
"complainant" means the individual, or the relevant person on behalf of an individual, who has 
made a complaint; 
"complaint" means a complaint under section 37; 
"correction", in relation to personal data, means rectification, erasure or completion; 
"daily penalty" means a penalty for each day on which the offence is continued after 
conviction therefor; 
"data" means any representation of information (including an expression of opinion) in any 
document, and includes a personal identifier; 
"data access request" means a request under section 18; 
"data correction request" means a request under section 22(1); 
"data protection principle" means any of the data protection principles set out in 
Schedule 1; 
"data subject", in relation to personal data, means the individual who is the subject of the 
data; 
"data user", in relation to personal data, means a person who, either alone or jointly or in 
common with other persons, controls the collection, holding, processing or use of the data; 
"data user return" means a data user return referred to in section 14(4); 
"disclosing", in relation to personal data, includes disclosing information inferred from the data; 
"document" includes, in addition to a document in writing-
(a) a disc, tape or other device in which data other than visual images are embodied so as to be 
capable, with or without the aid of some other equipment, of being reproduced from the 
disc, tape or other device; and 
(b) a film, tape or other device in which visual images are embodied so as to be capable, with or 
without the aid of some other equipment, of being reproduced from the film, tape or other 
device; 
"employment" means employment under-
(a) a contract of service or of apprenticeship; or 
(b) a contract personally to execute any work or labour, 
and related expressions shall be construed accordingly; 
"enforcement notice" means a notice under section 50(1); 
"financial regulator" means any of-
(a) the Monetary Authority appointed under section 5A of the Exchange Fund Ordinance (Cap 
66); 
(b) the Securities and Futures Commission established by section 3 of the Securities and Futures 
Commission Ordinance (Cap 24); 
(c) a clearing house within the meaning of section 2(1) of the Commodities Trading Ordinance IP/N/1/HKGIUIl 
Page 5 
(Cap 250) or a recognized clearing house within the meaning of the Securities and Futures 
(Clearing Houses) Ordinance (Cap 420); 
(d) the Exchange Company within the meaning of section 2(1) of the Commodities Trading 
Ordinance (Cap 250); 
(e) the Exchange Company within the meaning of section 2(1) of the Stock Exchanges 
Unification Ordinance (Cap 361); 
(t) the Insurance Authority appointed under section 4 of the Insurance Companies Ordinance 
(Cap 41); 
(g) the Registrar of Occupational Retirement Schemes appointed under section 5 of the 
Occupational Retirement Schemes Ordinance (Cap 426); 
(ga) the Mandatory Provident Fund Schemes Authority established by section 6 of the 
Mandatory Provident Fund Schemes Ordinance (Cap 485); (Added 4 of 1998 s. 14) 
(h) a person specified in a notice under subsection (7) to be a regulator for the purposes of this 
definition; 
"inaccurate", in relation to personal data, means the data is incorrect, misleading, incomplete or 
obsolete; 
"inspection" means an inspection under section 36; 
"investigation" means an investigation under section 38; 
"log book", in relation to a data user, means the log book kept and maintained by the data user 
under section 27(1); 
"matching procedure" means any procedure whereby personal data collected for 1 or more 
purposes in respect of 1 0 or more data subjects are compared (except by manual means) with 
personal data collected for any other purpose in respect of those data subjects where the comparison­
(a) is (whether in whole or in part) for the purpose of producing or verifying data that; or 
(b) produces or verifies data in respect of which it is reasonable to believe that it is practicable 
that the data, 
may be used (whether immediately or at any subsequent time) for the purpose of taking adverse action 
against any ofthose data subjects; 
"matching procedure request" means a request under section 31 (1); 
"personal data" means any data-
(a) relating directly or indirectly to a living individual; 
(b) from which it is practicable for the identity of the individual to be directly or indirectly 
ascertained; and 
(c) in a form in which access to or processing of the data is practicable; 
"personal data system" means any system, whether or not automated, which is used, 
whether in whole or in part, by a data user for the collection, holding, processing or use of personal 
data, and includes any document and equipment forming part of the system; 
"personal identifier" means an identifier-
(a) that is assigned to an individual by a data user for the purpose of the operations of the user; 
and 
(b) that uniquely identifies that individual in relation to the data user, 
but does not include an individual's name used to identify that individual; 
"practicable" means reasonably practicable; 
"prescribed officer" means a person employed or engaged under section 9(1); 
"processing", in relation to personal data, includes amending, augmenting, deleting or rearranging 
the data, whether by automated means or otherwise; 
"register" means the' register of data users kept and maintained by the Commissioner under 
section 15(1); 
"relevant data user", in relation to-
(a) an inspection, means the data user who uses the personal data system which is the subject 
of the inspection; 
(b) a complaint, means the data user specified in the complaint; 
(c) an investigation-
(i) in the case of an investigation initiated by a complaint, means the data user specified in 
the complaint; IP/N/1/HKGIUIl 
Page 6 
(H) in any other case, means the data user the subject of the investigation; 
(d) an enforcement notice, means the data user on whom the notice is served; 
"relevant person", in relation to an individual (howsoever the individual is described), means-
(a) where the individual is a minor, a person who has parental responsibility for the minor; 
(b) where the individual is incapable of managing his own affairs, a person who has been 
appointed by a court to manage those affairs; 
(c) in any other case, a person authorized in writing by the individual to make a data access 
request, a data correction request, or both such requests, on behalf of the individual; 
"requestor", in relation to-
(a) a data access request or data correction request, means the individual, or the relevant person 
on behalf of an individual, who has made the request; 
(b) a matching procedure request, means the data user who has made the request; 
"specified", in relation to a form, means specified under section 67; 
"third party", in relation to personal data, means any person other than-
(a) the data subject; 
(b) a relevant person in the case of the data subject; 
(c) the data user; or 
(d) a person authorized in writing by the data user to collect, hold, process or use the data-
(i) under the direct control of the data user; or 
(H) on behalf of the data user; 
"use", in relation to personal data, includes disclose or transfer the data; 
"would be likely to prejudice" includes would prejudice. 
(2) For the avoidance of doubt, it is hereby declared that paragraph (c) of the definition of "relevant 
person" shall not be construed-
(a) to entitle a person who has only been authorized to make a data access request on behalf of 
an individual to make a data correction request on behalf of the individual; 
(b) to entitle a person who has only been authorized to make a data correction request on behalf 
of an individual to make a data access request on behalf of the individual. 
(3) Where under this Ordinance an act may be done with the prescribed consent of a person (and 
howsoever the person is described), such consent-
(a) means the express consent of the person given voluntarily; 
(b) does not include any consent which has been withdrawn by notice in writing served on the 
person to whom the consent has been given (but without prejudice to so much of that act 
that has been done pursuant to the consent at any time before the notice is so served). 
(4) Subject to section 64(10), it is hereby declared that any reference in this Ordinance to the effect 
that a data user (howsoever described)-
includes-(a) has contravened a requirement under this Ordinance; or 
(b) is contravening a requirement under this Ordinance, 
(i) where paragraph (a) is applicable, any case where the data user has done an act, or engaged 
in a practice, in contravention of a data protection principle; 
(H) where paragraph (b) is applicable, any case where the data user is doing an act, or engaging 
in a practice, in contravention of a data protection principle. 
(5) Notwithstanding any other provisions of this Ordinance, a complaint may be made (and an 
investigation, if any, initiated by the complaint may be carried out) in relation to a person who has ceased to 
be a data user except any such person who has not at any time been a data user during the period of 2 years 
immediately preceding the date on which the Commissioner receives the complaint and, accordingly, a 
person in relation to whom such a complaint is made shall for the purposes of such complaint (and an 
investigation, if any, initiated by such complaint) be deemed to be a data user, and the other provisions of 
this Ordinance shall be construed accordingly. 
(6) Any reference in this Ordinance to a data protection principle followed by a number is a 
reference to the principle bearing that number set out in Schedule 1. 
(7) The Chief Executive may, by notice in the Gazette, specifY a person to be a regulator for the 
purposes of the definition of "financial regulator". (Amended 34 of 1999 s. 3) 
(8) It is hereby declared that a notice under subsection (7) is subsidiary legislation. (9) Where a person-IPIN/l/HKGIUIl 
Page 7 
(a) holds any office, engages in any profession or carries on any occupation; and 
(b) is required by any law, or by any rules made under or by virtue of any law, to be a fit and 
proper person (or words to the like effect) to hold that office, engage in that profession or 
carry on that occupation, 
then, for the purposes of this Ordinance, any conduct by that person by virtue of which he ceases, or would 
cease, to be such a fit and proper person shall be deemed to be seriously improper conduct. 
(10) Subsection (9) shall not operate to prevent seriously improper conduct including, for the purposes 
of this Ordinance, conduct by virtue of which a person ceases, or would cease, to be a fit and proper person 
notwithstanding that the conduct is not conduct to which that subsection applies. 
(11) Words and expressions importing the neuter gender in relation to any data user shall include the 
masculine and feminine genders. 
(12) A person is not a data user in relation to any personal data which the person holds, processes or 
uses solely on behalf of another person if, but only if, that first-mentioned person does not hold, process or 
use, as the case may be, those data for any of his own purposes. 
(13) For the avoidance of doubt, it is hereby declared that, for the purposes of this Ordinance, any 
conduct by a person by virtue of which he has or could become a disqualified person or a suspended person 
under the Rules of Racing and Instructions by the Stewards of the Hong Kong Jockey Club, as in force 
from time to time, is seriously improper conduct. (Amended 34 of 1999 s. 3) 
(Enacted 1995) IP/N/lIHKGIUIl 
Page 8 
Chapl;;:r; 486 
Section: 3 Title: PERSONAL DATA 
(PRfVACY}.ORDiNANCE 
Heading: Application 
(1) This Ordinance binds the Government. 
(2) (*Not adopted as the laws of HKSAR) Gazette Number: 
Version Date: 01107/1997 
(Enacted 1995) 
* See Decision of the Standing Committee of the National People's Congress on Treatment of the Laws 
Previously in Force in Hong Kong in accordance with Article 160 of the Basic Law of the Hong Kong 
Special Administrative Region of the People's Republic of China, which is published in volume 1, p. 
1111. Chupter: 486 Title: 
Section: 4 Heading: IP/N/1iHKGIUIl 
Page 9 
PBRSONAL DATA 
.{p:lUVACY).OROlNANCE Gazette Number: 
Data protection principles Version Date: 30/0611997 
A data user shall not do an act, or engage in a practice, that contravenes a data protection principle 
unless the act or practice, as the case may be, is required or permitted under this Ordinance. 
(Enacted 1995) IP/N/l/HKG/UIl 
Page 10 
Chapter: 486 Title: PERSONAL DATA 
(PR-lVACY)·ORDINANCE Oa~tteN.umber:: :34ofl999 
Section: s Hemiing: EstabHsbmen4 ett~f)f Version Date; o U07!l 997 
Prh'a~y CQmmissioner for 
Personal Data 
Remarks: 
Adaptation amendments retroactively made -see 34 of 1999 s. 3 
PART II 
ADMINISTRA nON 
(1) For the purposes of this Ordinance, there is hereby established an office by the name of the 
Privacy Commissioner for Personal Data. 
(2) The Commissioner shall be a corporation sole with perpetual succession and­
(a) shall have and may use a seal; and 
(b) shall be capable of suing and being sued. 
(3) The Chief Executive shall, by notice in the Gazette, appoint a person to be the Commissioner. 
(Amended 34 of 1999 s. 3) 
(4) Subject to subsection (5), the person appointed to be the Commissioner shall hold office for a 
period of 5 years and shall be eligible for reappointment for not more than 1 further period of 5 years. 
(5) The person appointed to be the Commissioner may-
(a) at any time resign from his office by notice in writing to the Chief Executive; or 
(b) be removed from office by the Chief Executive with the approval by resolution of the 
Legislative Council on the ground of-
(i) inability to perform the functions of his office; or 
(ii) misbehaviour. (Amended 34 of 1999 s. 3) 
(6) The Chief Executive shall determine- (Amended 34 of 1999 s. 3) 
(a) the emoluments; and 
(b) the terms and conditions of appointment, 
of the person appointed to be the Commissioner. 
(7) The provisions of Schedule 2 shall have effect with respect to the Commissioner. 
(8) Subject to subsection (9), the Commissioner shall not be regarded as a servant or agent of the 
Government or as enjoying any status, immunity or privilege of the Government. 
(9) The person appointed to be the Commissioner shall be deemed to be a public servant-
(a) within the meaning of section 2 of the Prevention of Bribery Ordinance (Cap 201); and 
(b) for the purposes of that Ordinance. 
(Enacted 1995) Chapter: 486 
Section: 
Remarks: Title: 
Heading: PERSONAL DATA 
WRfVACY) ORDINANCE 
C~mmiss:i()ner t()\luld no Version Date: 
other of rICe 
Adaptation amendments retroactively made -see 34 of 1999 s. 3 IP/N/lIHKG/U/1 
Page 11 
The person appointed to be the Commissioner shall not, without the specific approval of the Chief 
Executive- (Amended 34 of 1999 s. 3) 
(a) hold any office of profit other than his office as Commissioner; or 
(b) engage in any occupation for reward outside the functions of his office. 
(Enacted 1995) IP/N/lIHKGIUIl 
Page 12 
486 Titk: PERSONAL DATA 
(pRIVACY)·ORO.lNAI~CE 
rming()f te~porary 
va~an~y Gazette NUtr~her: :34 of 1999 
Section: 1 Head!ng: 
Remarks: 
Adaptation amendments retroactively made -see 34 of 1999 s. 3 
(1) Where the person appointed to be the Commissioner­
(a) dies; 
(b) resigns; 
(c) is removed from office; 
(d) is absent from Hong Kong; or Version Date: 
(e) is for any other reason unable to perform the functions of his office, 01/07 !l997 
then the Chief Executive may, by notice in writing, appoint a person to act as the Commissioner until, as the 
case requires- (Amended 34 of 1999 s. 3) 
(i) a new Commissioner is appointed under section 5(3); or 
(ii) the Commissioner resumes his office. 
(2) A person appointed under subsection (1) to act as the Commissioner, whilst he is so appointed­
(a) shall perform the functions; and 
(b) may exercise the powers, 
of the Commissioner under this Ordinance. 
(3) Section 6 shall apply to a person appointed under subsection (1) to act as the Commissioner as if 
that person were the Commissioner. 
(Enacted 1995) Chapter: 486 
Section: 
Remarks: PERSONAL DATA 
{PRfVA.C\) ORJ)fNANCE 
fun~tii)jlS ~md pi)wers ()f 
Commissioner IP/NIIIHKGIU/1 
Page 13 
Gamtte Number: J40f 1999 
{) 1 107!1997 
Adaptation amendments retroactively made -see 34 of 1999 s. 3 
(1) The Commissioner shall-
(a) monitor and supervise compliance with the provisions of this Ordinance; 
(b) promote and assist bodies representing data users to prepare, for the purposes of section 12, 
codes of practice for guidance in complying with the provisions of this Ordinance, in 
particular the data protection principles; 
(c) promote awareness and understanding of, and compliance with, the provisions of this 
Ordinance, in particular the data protection principles; 
(d) examine any proposed legislation (including subsidiary legislation) that the Commissioner 
considers may affect the privacy of individuals in relation to personal data and report the 
results of the examination to the person proposing the legislation; 
(e) carry out inspections, including inspections of any personal data systems used by data users 
which are departments of the Government or statutory corporations; 
(f) for the better performance of his other functions, undertake research into, and monitor 
developments in, the processing of data and computer technology in order to take account 
of any likely adverse effects such developments may have on the privacy of individuals in 
relation to personal data; 
(g) liaise and co-operate with any person in any place outside Hong Kong-
(i) performing in that place any functions which, in the opinion of the Commissioner, are 
similar (whether in whole or in part) to any ofthe Commissioner's functions under this 
Ordinance; and 
(ii) in respect of matters of mutual interest concerning the privacy of individuals in relation 
to personal data; and 
(h) perform such other functions as are imposed on him under this Ordinance or any other 
enactment. 
(2) The Commissioner may do all such things as are necessary for, or incidental or conducive to, the 
better performance of his functions and in particular but without prejudice to the generality of the foregoing, 
may-
(a) acquire and hold property of any description if in the opinion of the Commissioner such 
property is necessary for-
(i) the accommodation of the Commissioner or of any prescribed officer; or 
(ii) the performance of any function which the Commissioner may perform, 
and, subject to the terms and conditions upon which such property is held, dispose of it; 
(b) enter into, carry out, assign or accept the assignment of, vary or rescind, any contract, 
agreement or other obligation; 
(c) undertake and execute any lawful trust which has as an object the furtherance of any 
function which the Commissioner is required or is permitted by this Ordinance to perform or 
any other similar object; 
(d) accept gifts and donations, whether subject to any trust or not; 
(e) with the prior approval of the Chief Executive, become a member of or affiliate to any 
international body concerned with (whether in whole or in part) the privacy of individuals in 
relation to personal data; (Amended 34 of 1999 s. 3) 
(t) exercise such other powers as are conferred on him under this Ordinance or any other 
enactment. 
(3) The Commissioner may make and execute any document in the performance of his functions or 
the exercise of his powers or in connection with any matter reasonably incidental to or consequential upon 
the performance of his functions or the exercise of his powers. IP/N/l/HKGIU11 
Page 14 
(4) Any document purporting to be executed under the seal of the Commissioner shall be admitted in 
evidence and shall, in the absence of evidence to the contrary, be deemed to have been duly executed. 
(5) The Commissioner may from time to time cause to be prepared and published by notice in the 
Gazette, for the guidance of data users, guidelines not inconsistent with this Ordinance, indicating the 
manner in which he proposes to perform any of his functions, or exercise any of his powers, under this 
Ordinance. 
(Enacted 1995) Chapter: 486 Title: 
Section: 9 Heading: PERSONALDAfA 
(PRlV ACY)ORDlNANCB 
Staff of Commissioner, etc. Version Date: IP/N/1/HKGIUIl 
Page 15 
30106/1997 
(1) The Commissioner may-
(a) employ such persons (including technical and professional persons); and 
(b) engage, other than by way of employment, such technical and professional persons, 
as he thinks fit to assist him in the performance of his functions, and the exercise of his powers, under this 
Ordinance. 
(2) The Commissioner shall determine-
(a) the remuneration and terms and conditions of employment of any person, or any person 
belonging to a class of persons, who may be employed under subsection (l)(a); 
(b) the remuneration and terms and conditions of engagement of any person, or any person 
belonging to a class of persons, who may be engaged under subsection (1 )(b). 
(3) The Commissioner may-
(a) grant, or make provision for the grant of, pensions, gratuities and retirement benefits to 
employees; 
(b) provide other benefits for the welfare of employees and their dependants; 
(c) authorize payments, whether or not legally due, to the personal representatives of a 
deceased employee or to any person who was dependent on such employee at his death. 
(4) The Commissioner may-
(a) establish, manage and control; or 
(b) enter into an arrangement with any company or assocIatIOn for the establishment, 
management and control by that company or association either alone or jointly with the 
Commissioner of, 
any fund or scheme for the purpose of providing for the pensions, gratuities, benefits and payments referred 
to in subsection (3). 
(5) The Commissioner may make contributions to and may require employees to make contributions 
to any fund or scheme referred to in subsection (4). 
(6) In this section "employees" includes any class of employee which the Commissioner 
specifies and in subsection (3) includes former employees. 
(Enacted 1995) IP/N/1/HKG/U/1 
Page 16 
Ch~pter: 486 Title: 
Secdon:- it) Heading: PERSONAL DATA 
(pRlVACY) ORDINA"{cE 
l)degations by 
Ctlmmissioner Gazett~ Number: 
Version Date: 30/06/199] 
(1) Subject to subsection (2), the Commissioner may delegate in writing any of his functions or 
powers under this Ordinance to any prescribed officer subject to such terms and conditions, if any, as he 
thinks fit and specified in the delegation. 
(2) The Commissioner shall not delegate any of his functions or powers under­
(a) subsection (1); 
(b) any provisions of any regulations made under this Ordinance which are specified in the 
regulations as provisions which shall not be subject to subsection (1); 
(c) any provisions of Schedule 2 which are specified in that Schedule as provisions which shall 
not be subject to subsection (1). 
(3) A delegate of the Commissioner-
(a) shall perform the delegated functions and may exercise the delegated powers as if the 
delegate were the Commissioner; and 
(b) shall be presumed to be acting in accordance with the relevant delegation in the absence of 
evidence to the contrary. 
(Enacted 1995) Owpter: .486 Title: 
Section: H Heading: .PERSONA..LDATA 
(PEi"VACY)ORDINANCB 
EstabUs~m~ntofPers().:na.l Version. Date; 
Dats·.(pnvac:y) •. Advisary 
C€)mmittce IP/N/1/HKG/U/I 
Page 17 
3()f06! 1997 
(l) There is hereby established a committee by the name of the Personal Data (Privacy) Advisory 
Committee for the purpose of advising the Commissioner upon any matter relevant to the privacy of 
individuals in relation to personal data or otherwise relevant to the operation of this Ordinance. 
(2) The Committee shall consist of-
(a) the Commissioner, who shall be the chairman; and 
(b) not less than 4 or more than 8 other persons, appointed by the Secretary for Home Affairs, 
of whom-
(i) not less than 1 shall have not less than 5 years' experience in the processing of data; 
and 
(ii) not more than 1 shall be a public officer. 
(3) The members of the Committee appointed under subsection (2)(b) shall hold office for such 
period and upon such terms as the Secretary for Home Affairs specifies in their respective appointments or 
from time to time. 
(4) A member of the Committee appointed under subsection (2)(b) may resign at any time by notice 
in writing delivered to the Secretary for Home Affairs. 
(5) The Committee may regulate its procedure. 
(Enacted 1995) IP/NI1 IHKG/U!l 
Page 18 
Chart~r: 48:6 Title: 
Section: 12 fk:ading; PERSONAL DATA 
(pRJVACY)ORDrNANCE Gazette Number: 
Approval I,)f (:OO(lsof Version Date: 
practice by Commissioner 
PART III 
CODES OF PRACTICE 30!06fl997 
(1) Subject to subsections (8) and (9), for the purpose of providing practical guidance in respect of 
any requirements under this Ordinance imposed on data users, the Commissioner may-
( a) approve and issue such codes of practice (whether prepared by him or not) as in his opinion 
are suitable for that purpose; and 
(b) approve such codes of practice issued or proposed to be issued otherwise than by him as in 
his opinion are suitable for that purpose. 
(2) Where a code of practice is approved under subsection (1), the Commissioner shall, by notice in 
the Gazette-
(a) identify the code concerned and specify the date on which its approval is to take effect; and 
(b) specify for which of the requirements under this Ordinance the code is so approved. 
(3) The Commissioner may-
(a) from time to time revise the whole or any part of any code of practice prepared by him 
under this section; and 
(b) approve any revision or proposed revision of the whole or any part of any code of practice 
for the time being approved under this section, 
and the provisions of subsection (2) shall, with the necessary modifications, apply in relation to the approval 
of any revision under this subsection as they apply in relation to the approval of a code of practice under 
subsection (1). 
(4) The Commissioner may at any time withdraw his approval from any code of practice approved 
under this section. 
(5) Where under subsection (4) the Commissioner withdraws his approval from a code of practice 
approved under this section, he shall, by notice in the Gazette, identify the code concerned and specify the 
date on which his approval of it is to cease to have effect. 
(6) References in this Ordinance to an approved code of practice are references to that code as it has 
effect for the time being by virtue of any revision of the whole or any part of it approved under this section. 
(7) The power of the Commissioner under subsection (1)(b) to approve a code of practice issued or 
proposed to be issued otherwise than by him shall include power to approve a part of such a code and, 
accordingly, in this Ordinance "code of practice" may be read as including a part of such a 
code. 
(8) The Commissioner shall, not later than 6 months after the day on which this section comes into 
operation (or within such further period, not exceeding 6 months, as the Secretary for Home Affairs may 
allow), approve a code of practice under subsection (1) in respect of all or any requirements referred to in 
that subsection in so far as such requirements relate to personal data which are personal identifiers. 
(9) The Commissioner shall, before approving a code of practice under subsection (1) or any 
revision or proposed revision of the code under subsection (3), consult with-
(a) such bodies representative of data users to which the code or the code as so revised, as the 
case may be, will apply (whether in whole or in part); and 
(b) such other interested persons, 
as he thinks fit. 
(10) For the avoidance of doubt, it is hereby declared that different codes of practice may be 
approved under subsection (1) (including any code of practice referred to in subsection (8)) for different 
classes of data users, and may be so approved for the same or different requirements referred to in 
subsection (1). 
(Enacted 1995) Chapter: 486 Title; 
13 PERSQNALDATA 
(PR1VACy)OWtN,<\N'CE 
U'scofappraVed~~~ ()f 
pr~~ti~e.npra~~e4~ngs 
under this: Ordinance Il?~/l/fI}(Ci/lJ/l 
l?age 19 
Gazette Number: 
30f061199'7 
(1) A failure on the part of any data user to observe any provision of an approved code of practice 
shall not of itself render the data user liable to any civil or criminal proceedings but where in any proceedings 
under this Ordinance a data user is alleged to have contravened a requirement under this Ordinance, being a 
requirement for which there was an approved code of practice at the time of the alleged contravention, 
subsection (2) shall have effect with respect to such code in relation to those proceedings. 
(2) Any provision of a code of practice which appears to a specified body to be relevant to a 
requirement under this Ordinance alleged to have been contravened shall be admissible in evidence in the 
proceedings under this Ordinance concerned and if it is proved that there was at any material time a failure 
to observe any provision of the code which appears to that body to be relevant to any matter which it is 
necessary to prove in order to establish a contravention of such requirement, that matter shall be taken as 
proved in the absence of evidence that such requirement was in respect of that matter complied with 
otherwise than by way of observance of that provision. 
(3) In any proceedings under this Ordinance, a code of practice which appears to a specified body to 
be the subject of a notice under section 12 shall be taken to be the subject of such notice in the absence of 
evidence to the contrary. 
(4) In this section-
"proceedings under this Ordinance" includes any criminal proceedings 
where a data user is alleged to have committed an offence by reason of a contravention of a 
requirement under this Ordinance; 
"specified body" means-
(a) a magistrate; 
(b) a court; or 
(c) the Administrative Appeals Board. 
(Enacted 1995) IJ>~/l/lJ}((J/lJ/l 
J>age 20 
Chapter: 486 
Section: 14 Title: 
Heading: PERSONAL DATA 
(pRIVACY) ORDINANCE 
Data user returns 
PART IV Version Date: 
DATA lJSER RETlJRNS AND RECJISTER OF DATA lJSERS 30/0611997 
(1) Subject to subsection (2), the Commissioner may, by notice in the (Jazette, specify a class of 
data users to which this section shall apply. 
(2) The Commissioner shall, before specifying a class of data users in a notice under subsection (1), 
consult with-
(a) such bodies representative of data users belonging to that class; and 
(b) such other interested persons, 
as he thinks fit. 
(3) This section shall not apply to a data user except a data user belonging to a class of data users 
specified in a notice under subsection (1) which is in force. 
(4) A data user shall submit to the Commissioner a data user return­
(a) in the specified form; 
(b) containing the prescribed information required by the return in relation to the data user; 
( c) in the case of-
(i) a data user which belongs to the class of data users concerned on the day on which 
the notice under subsection (1) specifying that class commences, not earlier than 3 
months before, and not later than, each anniversary of that day; 
(ii) a data user which first belongs to the class of data users concerned on a day after the 
day on which the notice under subsection (1) specifying that class commences, not 
earlier than 3 months before, and not later than, each anniversary of that 
first-mentioned day; and 
(d) accompanied by the prescribed fee. 
(5) The Commissioner shall cause a notice to be published not less than once during every period of 
6 months-
(a) m-
(i) the (Jazette; and 
(ii) not less than 1 Chinese language newspaper (and in the Chinese language) and not less 
than 1 English language newspaper (and in the English language), each of which shall 
be a newspaper circulating generally in Hong Kong; and 
(b) subject to subsection (6), specifying the places at which and the hours during which data 
user returns are available to be obtained by data users for the purposes of this section. 
(6) The Commissioner shall not exercise his power under subsection (5)(b) to specify places which 
are (Jovemment offices unless and until he has the approval in writing of the Secretary for Home Affairs to 
do so. 
(7) The Commissioner shall cause data user returns to be available to be obtained by data users­
(a) free of charge; and 
(b) at the places and during the hours specified in the last notice published under subsection (5). 
(8) Where any prescribed information contained in a data user return submitted under subsection (4) 
to the Commissioner by a data user changes subsequent to the submission, then the data user shall serve a 
notice in writing on the Commissioner specifying such change-
(a) if, but only if-
(i) such information is specified in the return as information to which this subsection 
applies; and 
(ii) the return contains, or has annexed to it­
CA) a copy of this subsection; or 
(B) a statement summarizing the requirement imposed by this subsection on the data user; and 
(b) not later than 30 days after such change. 
(9) It is hereby declared that-
(a) a notice under subsection (1) is subsidiary legislation; IPIN/1/HKGIU/1 
Page 21 
(b) where a data user belongs to 2 or more classes of data users specified in 2 or more notices 
under subsection (1) which are in force, then, for the purposes of this section, that data user 
shall be deemed to belong only to that class of data users specified in the first of those 
notices to be published in the Gazette; and 
(c) subsection (3) shall not operate to prejudice the generality of section 67(4)( c). 
(10) In this section and section 15, "prescribed information" means any information 
specified in Schedule 3. 
(Enacted 1995) IJ>~/1/lIFC(J/LJ/1 
J>age 22 
Chapter: 486 Tide; PERSONAL DATA Gamtt~ Numher: 
(pRlVACY)ORD1NANCE 
Section: 15 Heading: Register of data users Version Date: 30106/1997 
(l) The Commissioner shall use-
(a) data user returns submitted to him under section 14(4); and 
(b) any notices served on him under section 14(8), 
to keep and maintain a register of data users which have submitted such returns. 
(2) The register shall-
(a) be in the form of a database; and 
(b) contain, in respect of each data user who has submitted a data user return under section 
14(4), such particulars of the information supplied in that return as the Commissioner thinks 
fit. 
(3) The Commissioner may, by notice in writing served on a data user, require the data user to 
submit a notice in the prescribed form containing such prescribed information in relation to the data user as 
the Commissioner may reasonably require in order to keep and maintain the register in so far as it relates to 
that data user, and the data user shall so submit the second-mentioned notice within such period (being a 
period of not less than 30 days after service of the first-mentioned notice) and in such manner as the 
Commissioner requires in the first-mentioned notice. 
(4) Where any prescribed information submitted to the Commissioner under subsection (3) by a data 
user changes subsequent to the submission, then the data user shall serve a notice in writing on the 
Commissioner specifying such change-
(a) if, but only if-
(i) such information is specified in the notice concerned under that subsection as 
information to which this subsection applies; and 
(ii) the notice referred to in subparagraph (i) contains, or has annexed to it­
(A) a copy of this subsection; or 
(B) a statement summarizing the requirement imposed by this subsection on the data 
user; and 
(b) not later than 30 days after such change. 
(5) If the Commissioner is satisfied that a person has ceased to be a data user, he may delete from 
the register any particulars contained therein relating to that person in that person's capacity as a data user. 
(6) A person who has ceased to be a data user may, by notice in the specified form served on the 
Commissioner, request the Commissioner to delete from the register the particulars contained therein 
relating to that person in that person's capacity as a data user, and the Commissioner shall, not later than 3 
months after the date on which he receives that notice, comply with that request unless it has been 
withdrawn by that person. 
(Enacted 1995) IPIN/1/HKGlU11 
Page 23 
Ch~pter: 486 Tit!oe: PERSONAL DATA Oa-le:tte Number: 
(PRIVACY) ORDIN/\NCE 
Section: 16 Heading: Inspection of register Version Date: 30/0611997 
(1) The Commissioner shall provide facilities for making the particulars contained in the register 
available for inspection-
(a) by any person; 
(b) in visible and legible form; 
(c) during ordinary office hours; and 
(d) free of charge. 
(2) The Commissioner shall-
(a) on receipt of an application in the specified form from a person; and 
(b) on payment of the prescribed fee, 
provide a copy in writing of the particulars contained in the register in respect of the data user, or the class 
of data users, specified in the application. 
(Enacted 1995) IP/N/lIHKGIUIl 
Page 24 
Chapter: 486 
Section: Title: 
Heading: PERSONl\L.DA·fA· 
(PRJ\lACY)··OR!!tNANCE 
Register snaUnotJimit", de. Verskm· Date: 
operati~n of this OrdInance 
(1) For the avoidance of doubt, it is hereby declared that­
(a) whether or not the register contains any particulars; 
(b) any particulars contained in the register, 
in respect of a data user shall not of itself-3{}!06J 19~1· 
(i) limit, restrict or qualify the operation of any of the provisions of this Ordinance (including 
section 2(5) and the data protection principles) in relation to the data user; 
(ii) exempt the data user from the operation of any of the provisions of this Ordinance. 
(2) Subsection (1) shall not prejudice the operation of any limitation, restriction, qualification or 
exemption provided for in the other provisions of this Ordinance. 
(Enacted 1995) Chapt~r: 486 
Section: 18 Heading: PBRSONAL DATAGa.7k'tt~ Number: 
(PRfVACY) ORDtNANCE 
Data access request Version Date: 
PART V 
ACCESS TO AND CORRECTION OF PERSONAL DATA IP/N/1/HKG/U!1 
Page 25 
30/0611997 
(1) An individual, or a relevant person on behalf of an individual, may make a request-
(a) to be informed by a data user whether the data user holds personal data of which the 
individual is the data subject; 
(b) if the data user holds such data, to be supplied by the data user with a copy of such data. 
(2) A data access request under both paragraphs of subsection (1) shall be treated as being a single 
request, and the provisions of this Ordinance shall be construed accordingly. 
(3) A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to 
the contrary, be treated as being a data access request under both paragraphs of that subsection, and the 
provisions of this Ordinance (including subsection (2)) shall be construed accordingly. 
(4) A data user who, in relation to personal data-
(a) does not hold the data; but 
(b) controls the use of the data in such a way as to prohibit the data user who does hold the 
data from complying (whether in whole or in part) with a data access request which relates 
to the data, 
shall be deemed to hold those data, and the provisions of this Ordinance (including this section) shall be 
construed accordingly. 
(Enacted 1995) IPINIlIHKG/UI 1 
Page 26 
Chapter: 486 Tide: 
Stx.tion: 19 PERSONAL DATA 
(PRIV ACY}ORDrNl\.NCE 
C~Hn pUam::e-witbdata 
access request Version Date: 30106/1997 
(1) Subject to subsection (2) and sections 20 and 28(5), a data user shall comply with a data access 
request not later than 40 days after receiving the request. 
(2) A data user who is unable to comply with a data access request within the period specified in 
subsection (1) shall-
(a) before the expiration ofthat period-
(i) by notice in writing inform the requestor that the data user is so unable and of the 
reasons why the data user is so unable; and 
(ii) comply with the request to the extent, if any, that the data user is able to comply with 
the request; and 
(b) as soon as practicable after the expiration of that period, comply or fully comply, as the case 
may be, with the request. 
(3) A copy of the personal data to be supplied by a data user in compliance with a data access 
request shall-
(a) be supplied by reference to the data at the time when the request is received except that the 
copy may take account of-
(i) any processing of the data-
(A) made between that time and the time when the copy is supplied; and 
(B) that would have been made irrespective of the receipt of the request; and 
(ii) subject to subsection (5), any correction to the data made between that time and the 
time when the copy is supplied; 
(b) where any correction referred to paragraph (a)(ii) has been made to the data, be 
accompanied by a notice stating that the data have been corrected pursuant to that 
paragraph (or words to the like effect); and 
(c) as far as practicable, be-
(i) intelligible unless the copy is a true copy of a document which­
(A) contains the data; and 
(B) is unintelligible on its face; 
(ii) readily comprehensible with any codes used by the data user adequately explained; 
and 
(iii) lll-
(iv) 
(v) 
(4) Where­(A) subject to sub-subparagraph (B), the language specified in the request or, if no 
language is so specified, the language in which the request is made (which may 
be the Chinese or English language in either case); 
(B) a language other than the language specified in the request or, if no language is 
so specified, the language in which the request is made, if, but only if-
(I) the language in which the data are held is not the language specified in the 
request or, if no language is so specified, the language in which the request 
is made, as the case may be; and 
(ll) subject to section 20(2)(b), the copy is a true copy of a document which 
contains the data; 
without prejudice to the generality of subparagraph (iii) but subject to subsection (4), 
be in the form, or one of the forms, if any, specified in the request; 
where subparagraph (iv) is not applicable, in such form as the data user thinks fit. 
(a) a data access request specifies the form or forms in which a copy of the personal data to be 
supplied in compliance with the request is or are sought; and 
(b) the data user concerned is unable to supply the copy in that form or any of those forms, as 
the case may be, because it is not practicable for the data user to do so, then the data user shall-IP/N/lIHKGIUIl 
Page 27 
(i) where there is only one form in which it is practicable for the data user to supply the copy, 
supply the copy in that form accompanied by a notice in writing informing the requestor that 
that form is the only form in which it is practicable for the data user to supply the copy; 
(ii) in any other case-
(A) as soon as practicable, by notice in writing inform the requestor-
(I) that it is not practicable for the data user to supply the copy in the form or any 
of the forms, as the case may be, specified in the request; 
(11) of the forms in which it is practicable for the data user to supply the copy; and 
(Ill) that the requestor may, not later than 14 days after the requestor has received 
the notice, specify in writing one of the forms referred to in sub-subparagraph 
(11) in which the copy is to be supplied; and 
(B) as soon as practicable, supply the copy-
(I) in the form specified in the response, if any, to the notice referred to in 
subparagraph (A); 
(11) if there is no such response within the period specified in subparagraph (A)(III), 
supply the copy in anyone of the forms referred to in subparagraph (A)(Il) as 
the data user thinks fit. 
(5) Subparagraph (ii) of paragraph (a) and paragraph (b) of subsection (3) shall expire on the 1st 
anniversary of the appointed day. 
(Enacted 1995) IP/N/lIHKGIUII 
Page 28 
486 Title: 
Section: 20 Heading: PERSONALOATA 
{PRlVACY)ORDfNANCE Gazette Number: 
CireUntstan(:t$~ll '\~bkh Version .Date~ 
dutauser .shan~r may 
refuse to comply with data 
access request 30/0Q/1997 
(1) A data user shall refuse to comply with a data access request-
(a) if the data user is not supplied with such information as the data user may reasonably 
require-
(i) in order to satisfY the data user as to the identity of the requestor; 
(ii) where the requestor purports to be a relevant person, in order to satisfY the data user­
(A) as to the identity of the individual in relation to whom the requestor purports to 
be such a person; and 
(B) that the requestor is such a person in relation to that individual; 
(b) subject to subsection (2), if the data user cannot comply with the request without disclosing 
personal data of which any other individual is the data subject unless the data user is 
satisfied that the other individual has consented to the disclosure of the data to the requestor; 
or 
(c) in any other case, if compliance with the request is for the time being prohibited under this 
Ordinance. 
(2) Subsection (1)(b) shall not operate-
(a) so that the reference in that subsection to personal data of which any other individual is the 
data subject includes a reference to information identifYing that individual as the source of 
the personal data to which the data access request concerned relates unless that information 
names or otherwise explicitly identifies that individual; 
(b) so as to excuse a data user from complying with the data access request concerned to the 
extent that the request may be complied with without disclosing the identity of the other 
individual, whether by the omission of names, or other identifYing particulars, or otherwise. 
(3) A data user may refuse to comply with a data access request if-
(a) the request is not in writing in the Chinese or English language; 
(b) the data user is not supplied with such information as the data user may reasonably require 
to locate the personal data to which the request relates; 
(c) the request follows 2 or more similar requests made by-
(i) the individual who is the data subject in respect of the personal data to which the 
request relates; 
(ii) one or more relevant persons on behalf of that individual; or 
(iii) any combination of that individual and those relevant persons, 
and it is unreasonable in all the circumstances for the data user to comply with the request; 
(d) subject to subsection (4), any other data user controls the use of the data in such a way as 
to prohibit the first-mentioned data user from complying (whether in whole or in part) with 
the request; 
(e) the form in which the request shall be made has been specified under section 67 and the 
request is not made in that form; or 
(t) in any other case, compliance with the request may for the time being be refused under this 
Ordinance, whether by virtue of an exemption under Part VIII or otherwise. 
(4) Subsection (3)(d) shall not operate so as to excuse a data user from complying with the data 
access request concerned-
(a) in so far as the request relates to section 18(1)(a), to any extent; 
(b) in so far as the request relates to section 18(1 )(b), to any extent that the data user can 
comply with the request without contravening the prohibition concerned. 
(Enacted 1995) Chapter: 486 Trtle: 
Section; 21 He.acling: PERSONAL-DATA 
(PRlVACY)ORDlNA>...rCE 
Notificatio n of refusal to 
~(tmplywitb data access 
request Version Date: IPINIlIHKG/UIl 
Page 29 
3Q!06l1'997 
(1) Subject to subsection (2), a data user who pursuant to section 20 refuses to comply with a data 
access request shall, as soon as practicable but, in any case, not later than 40 days after receiving the 
request, by notice in writing inform the requestor-
(a) of the refusal; 
(b) subject to subsection (2), of the reasons for the refusal; and 
(c) where section 20(3)(d) is applicable, of the name and address of the other data user 
concerned. 
(2) Where-
(a) a data user has pursuant to section 20 refused to comply with a data access request; and 
(b) the refusal also relates to section 18(1)(a) by virtue of section 63, 
then the data user may, in the notice under subsection (1) concerned, in place of the matters of which the 
data user is required to inform the requestor under that subsection, inform the requestor that the data user 
has no personal data the existence of which he is required to disclose to the requestor (or words to the like 
effect). 
(Enacted 1995) IP/N/1/HKG/U/1 
Page 30 
Ch~pter: 486 Title: PERSONAL DATA Gazette Number: 
(pRJVACY)ORDINAN'CE 
Section: 22 Heading: Data correction request Version Date: 30/0611997 
(1) Subject to subsection (2), where-
(a) a copy of personal data has been supplied by a data user in compliance with a data access 
request; and 
(b) the individual, or a relevant person on behalf of the individual, who is the data subject 
considers that the data are inaccurate, 
then that individual or relevant person, as the case may be, may make a request that the data user make the 
necessary correction to the data. 
(2) A data user who, in relation to personal data­
(a) does not hold the data; but 
(b) controls the processing of the data in such a way as to prohibit the data user who does hold 
the data from complying (whether in whole or in part) with section 23(1) in relation to a data 
correction request which relates to the data, 
shall be deemed to be a data user to whom such a request may be made, and the provisions of this 
Ordinance (including subsection (1)) shall be construed accordingly. 
(3) Without prejudice to the generality of sections 23(1)(c) and 25(2), if a data user, subsequent to 
the receipt of a data correction request but before complying with the request pursuant to section 24 or 
refusing to comply with the request pursuant to section 25, discloses to a third party the personal data to 
which the request relates, then the user shall take all practicable steps to advise the third party that the data 
are the subject of a data correction request still under consideration by the user (or words to the like effect). 
(Enacted 1995) Chapter: 486 Title: 
Section: 23 Heading: PERSONALDATA 
(pRJVACY) ORDINANCE 
COin pH~ulC:~ with data 
corredion request IP/N/IIHKGIUIl 
Page 31 
Gazette Number: 
Version Date: 30106/1997 
(1) Subject to subsection (2) and section 24, a data user who is satisfied that personal data to which 
a data correction request relates are inaccurate shall, not later than 40 days after receiving the request­
(a) make the necessary correction to those data; 
(b) supply the requestor with a copy of those data as so corrected; and 
(c) subject to subsection (3), if-
(i) those data have been disclosed to a third party during the 12 months immediately 
preceding the day on which the correction is made; and 
(ii) the data user has no reason to believe that the third party has ceased using those data 
for the purpose (including any directly related purpose) for which the data were 
disclosed to the third party, 
take all practicable steps to supply the third party with a copy of those data as so corrected 
accompanied by a notice in writing stating the reasons for the correction. 
(2) A data user who is unable to comply with subsection (1) in relation to a data correction request 
within the period specified in that subsection shall-
(a) before the expiration ofthat period-
(i) by notice in writing inform the requestor that the data user is so unable and of the 
reasons why the data user is so unable; and 
(ii) comply with that subsection to the extent, if any, that the data user is able to comply 
with that subsection; and 
(b) as soon as practicable after the expiration of that period, comply or fully comply, as the case 
may be, with that subsection. 
(3) A data user is not required to comply with subsection (1)(c) in any case where the disclosure 
concerned of the personal data to the third party consists of the third party's inspection of a register or other 
like document-
(a) in which the data are entered or otherwise recorded; and 
(b) which is available for inspection by the public, 
but this subsection shall not apply if the third party has been supplied with a copy, certified by or under the 
authority of the data user to be correct, of the data. 
(Enacted 1995) IP/N/lIHKGIUIl 
Page 32 
Chapter: 486 Titk: 
Section: 14 PERSONAL DATA 
(pRiVACY} ORDINANCE Gazette Number: 
Circumstances in whkh V~rsiQn Date: 
.data user sfulUor may 
refuse to comply with d~ta 
correction request 
(1) Subject to subsection (2), a data user shall refuse to comply with section 23(1) in relation to a 
data correction request if the data user is not supplied with such information as the data user may reasonably 
require-
(a) in order to satisfY the data user as to the identity of the requestor; 
(b) where the requestor purports to be a relevant person, in order to satisfY the data user-
(i) as to the identity of the individual in relation to whom the requestor purports to be 
such a person; and 
(ii) that the requestor is such a person in relation to that individual. 
(2) Subsection (1) shall not apply to a data correction request where the requestor is the same person 
as the requestor in respect of the data access request which gave rise to the data correction request. 
(3) A data user may refuse to comply with section 23(1) in relation to a data correction request if­
(a) the request is not in writing in the Chinese or English language; 
(b) the data user is not satisfied that the personal data to which the request relates are 
inaccurate; 
(c) the data user is not supplied with such information as the data user may reasonably require 
to ascertain in what way the personal data to which the request relates are inaccurate; 
(d) the data user is not satisfied that the correction which is the subject of the request is 
accurate; or 
(e) subject to subsection (4), any other data user controls the processing of the personal data to 
which the request relates in such a way as to prohibit the first-mentioned data user from 
complying (whether in whole or in part) with that section. 
(4) Subsection (3)(e) shall not operate so as to excuse a data user from complying with section 23(1) 
in relation to the data correction request concerned to the extent that the data user can comply with that 
section without contravening the prohibition concerned. 
(Enacted 1995) Chapter: 486 Title: 
Section: 25 PERSONAL DATA 
(PRfVACY) ORDNANCE 
Notifh:atiou of refusal to" 
comply with data 
correctioureqlltlst;ete. IPINIl/HKG/UIl 
Page 33 
Gazette Number: 
Version Date: 30J06l1997 
(1) A data user who pursuant to section 24 refuses to comply with section 23(1) in relation to a data 
correction request shall, as soon as practicable but, in any case, not later than 40 days after receiving the 
request, by notice in writing inform the requestor-
(a) of the refusal and the reasons for the refusal; and 
(b) where section 24(3)(e) is applicable, of the name and address of the other data user 
concerned. 
(2) Without prejudice to the generality of subsection (1), where-
(a) the personal data to which a data correction request relates are an expression of opinion; and 
(b) the data user concerned is not satisfied that the opinion is inaccurate, 
then the data user shall-
(i) make a note, whether annexed to that data or elsewhere-
(A) of the matters in respect of which the opinion is considered by the requestor to be 
inaccurate; and 
(B) in such a way that those data cannot be used by a person (including the data user and 
a third party) without the note being drawn to the attention of, and being available for 
inspection by, that person; and 
(ii) attach a copy of the note to the notice referred to in subsection (1) which relates to that 
request. 
(3) In this section, "expression of opinion" includes an assertion of fact which­
(a) is unverifiable; or 
(b) in all the circumstances of the case, is not practicable to verify. 
(Enacted 1995) IP/N/1/HKG/UIl 
Page 34 
Chapter; 486 Title: 
26 Heading~ PERSONAL DATA 
(PruVAC'{)ORDfNA.:.~CE Gazette Number: 
Eras-ure ofpers(yrlaldata no VersiQu D<ite: 
longer required 
(1) A data user shall erase personal data held by the data user where the data are no longer required 
for the purpose (including any directly related purpose) for which the data were used unless-
(a) any such erasure is prohibited under any law; or 
(b) it is in the public interest (including historical interest) for the data not to be erased. 
(2) For the avoidance of doubt, it is hereby declared that-
(a) a data user shall erase personal data in accordance with subsection (1) notwithstanding that 
any other data user controls (whether in whole or in part) the processing of the data; 
(b) the first-mentioned data user shall not be liable in an action for damages at the suit of the 
second-mentioned data user in respect of any such erasure. 
(Enacted 1995) Chapter: 48Q Title; 
Section: 27 Heading; Ifl~/I/lIFCCi/lJ/l 
flage 35 
PERSONAL DATA Gazette Number: 
(pRIVACY)ORDLNANCE 
IAgbook to .~kept lit data Ve:rsIOfl Date; 30106/ 1997 
user 
(1) A data user shall keep and maintain a log book­
(a) for the purposes of this flart; 
(b) in the Chinese or English language; and 
(c) such that any particulars entered in the log book pursuant to this section are not erased 
there from before the expiration of-
(i) subject to subparagraph (ii), 4 years after the day on which they were so entered; 
(ii) such longer or shorter period as may be prescribed, either generally or in any particular 
case, by regulations made under section 70. 
(2) A data user shall in accordance with subsection (3) enter in the log book-
(a) where pursuant to section 20 the data user refuses to comply with a data access request, 
particulars of the reasons for the refusal; 
(b) where pursuant to section 21 (2) the data user does not comply with section 21 (I), 
particulars ofthe prejudice that would be caused to the interest protected by the exemption 
concerned under Part VIII if the existence or non-existence of the personal data to which the 
data access request concerned relates were disclosed; 
(c) where pursuant to section 24 the data user refuses to comply with section 23(1) in relation 
to a data correction request, particulars of the reasons for the refusal; 
(d) any other particulars required by regulations made under section 70 to be entered in the log 
book. 
(3) The particulars required by subsection (2) to be entered by a data user in the log book shall be so 
entered-
(a) in the case of particulars referred to in paragraph (a) of that subsection, on or before the 
notice under section 21(1) is served in respect of the refusal to which those particulars 
relate; 
(b) in the case of particulars referred to in paragraph (b) of that subsection, on or before the 
notice under section 21(1) is served in respect of the refusal to which those particulars 
relate; 
(c) in the case of particulars referred to in paragraph (c) of that subsection, on or before the 
notice under section 25(1) is served in respect of the refusal to which those particulars 
relate; 
(d) in the case of particulars referred to in paragraph (d) of that subsection, within the period 
specified in regulations made under section 70 in respect of those particulars. 
( 4 ) A data user shall-
(a) permit the Commissioner to inspect and copy the log book (or any part thereof) at any 
reasonable time; and 
(b) without charge, afford the Commissioner such facilities and assistance as the Commissioner 
may reasonably require for the purposes of such inspection and copying. 
(Enacted 1995) IP/N/1/HKGIUIl 
Page 36 
Chapt~r: 48~ 
28 Title: 
. Heading; PERSONAL DATA. 
(PRrvAC~<{) OR})INANtE 
lmpt)sidonoffetsbyda~ Version Date: 
user 30!O6!1997 
(1) A data user shall not impose a fee for complying or refusing to comply with a data access request 
or data correction request unless the imposition of the fee is expressly permitted by this section. 
(2) Subject to subsections (3) and (4), a data user may impose a fee for complying with a data 
access request. 
(3) No fee imposed for complying with a data access request shall be excessive. 
(4) Where pursuant to section 19(3)(c)(iv) or (v) or (4)(ii)(B)(II) a data user may comply with a data 
access request by supplying a copy of the personal data to which the request relates in one of 2 or more 
forms, the data user shall not, and irrespective of the form in which the data user complies with the request, 
impose a fee for complying with the request which is higher than the lowest fee the data user imposes for 
complying with the request in any of those forms. 
(5) A data user may refuse to comply with a data access request unless and until any fee imposed by 
the data user for complying with the request has been paid. 
(6) Where-
(a) a data user has complied with a data access request by supplying a copy of the personal data 
to which the request relates; and 
(b) the data subj ect, or a relevant person on behalf of the data subj ect, requests the data user to 
supply a further copy of those data, 
then the data user may, and notwithstanding the fee, if any, that the data user imposed for complying with 
that data access request, impose a fee for supplying that further copy which is not more than the 
administrative and other costs incurred by the data user in supplying that further copy. 
(Enacted 1995) Chapter: 486 Title: 
Section: 29 Heading: PERSONAL DATA 
(PRIVACy)ORD!NANCE 
~rvke and languagc<of 
certain notices IP/N/lIHKGIUIl 
Page 37 
Gazi!tte Num.ber: 
Version Date: 30!0611997 
Without prejudice to the generality of section 68, where pursuant to a data access request or data 
correction request a data user is required to, or may, inform a requestor of any matter by notice in writing, 
then the requestor shall be deemed not to be so informed unless and until the requestor is served with the 
notice-
(a) in the language in which the request is made if that language is Chinese or English; 
(b) in any other case, in the Chinese or English language as the data user thinks fit. 
(Enacted 1995) IP/N/lIHKGIUIl 
Page 38 
Chapter: 
Section: 486 Title: 
He:a£iing: PERSQNALDATA 
(PR.IVACY) ORDINANCE (}a;rette Number: LN. 409 of 
1997 
Matchingpro(~dllte: UQi tQ VersJonDate; 
be c.arrie:dnut. ex~e:pt with 01fOg/l997 
consent (}fduCasubject:,.ek, 
PART VI 
MATCHING PROCEDURES AND TRANSFERS OF PERSONAL DATA, ETC. 
(1) A data user shall not carry out, whether in whole or in part, a matching procedure-
(a) unless and until each individual who is a data subject of the personal data the subject of that 
procedure has given his prescribed consent to the procedure being carried out; 
(b) unless and until the Commissioner has consented under section 32 to the procedure being 
carried out; 
(c) unless the procedure-
(i) belongs to a class of matching procedures specified in a notice under subsection (2); 
and 
(ii) is carried out in accordance with the conditions, if any, specified in the notice; or 
(d) unless it is required or permitted under any provision of any Ordinance specified in Schedule 
4. 
(2) For the purposes of this section, the Commissioner may, by notice in the Gazette, specify­
(a) a class of matching procedures; 
(b) subject to subsection (3), the conditions, if any, subject to which a matching procedure 
belonging to that class shall be carried out. 
(3) The Commissioner shall, before specifying any conditions in a notice under subsection (2), 
consult with-
(a) such bodies representative of data users to which the conditions will apply (whether in whole 
or in part); and 
(b) such other interested persons, 
as he thinks fit. 
(4) It is hereby declared that a notice under subsection (2) is subsidiary legislation. 
(5) Subject to subsection (6), a data user shall not take adverse action against an individual in 
consequence (whether in whole or in part) of the carrying out of a matching procedure-
(a) unless the data user has served a notice in writing on the individual-
(i) specifying the adverse action it proposes to take and the reasons therefor; and 
(ii) stating that the individual has 7 days after the receipt of the notice within which to 
show cause why that action should not be taken; and 
(b) until the expiration of those 7 days. 
(6) Subsection (5) shall not operate to prevent a data user from taking adverse action against an 
individual if compliance with the requirements of that subsection would prejudice any investigation into the 
commission of an offence or the possible commission of an offence. 
(Enacted 1995) 486 Title: 
Heading:; PEIL.'-'ONAL DATA 
(PRtVACy) ORDiNANCE 
M.atebing.·.pracedure 
request IP/N/lIHKGIUIl 
Page 39 
Vets/Oil Date:· 30!06! 1997 
(1) A data user proposing to carry out, whether in whole or in part, a matching procedure may make 
a request-
(a) in the specified form; 
(b) to the Commissioner; and 
(c) seeking the Commissioner's consent under section 32 to the carrying out of that procedure. 
(2) Where 2 or more data users may each make a matching procedure request in respect of the same 
matching procedure, then any of those data users may make such a request on behalf of all those data users, 
and the provisions of this Ordinance (including subsection (1)) shall be construed accordingly. 
(3) Without prejudice to the generality of subsection (2), it is hereby declared that a matching 
procedure request may be made in relation to 2 or more matching procedures, or a series of matching 
procedures, and the other provisions of this Ordinance (including section 32) shall be construed accordingly. 
(Enacted 1995) IPIN/IIHKGIUIl 
Page 40 
Chapter; 486 
Section: 32 Title: PERSONALDATA 
(PRfVACY}ORDINANCE . .. ". 
net~f'minat~on Of matching Version. Date: 
procedure request 
(1) The Commissioner shall determine a matching procedure request­
(a) not later than 45 days after receiving the request; and 
(b) by taking into account the prescribed matters applicable to the request and-
(i) where he is satisfied as to those matters, serving a notice in writing on the requestor 
stating that he consents to the carrying out of the matching procedure to which the 
request relates subject to the conditions, if any, specified in the notice; 
(ii) where he is not so satisfied, serving a notice in writing on the requestor stating-
(A) that he refuses to consent to the carrying out of the matching procedure to which 
the request relates; and 
(B) such of those matters in respect of which he is not so satisfied and the reasons 
why he is not so satisfied. 
(2) For the avoidance of doubt, it is hereby declared that a consent in a notice under subsection 
(1 )(b )(i) to the carrying out of a matching procedure to which a matching procedure request relates shall not 
operate to prevent a data user who is neither the requestor nor, where section 31(2) applies to the request, 
any data user on whose behalf such request was made, from carrying out, whether in whole or in part, the 
procedure. 
(3) An appeal may be made to the Administrative Appeals Board­
( a) against-
(i) any conditions specified in a notice under subsection (1) (b )(i); or 
(ii) any refusal specified in a notice under subsection (1) (b)(ii); and 
(b) by the requestor on whom the notice was served or any data user on whose behalf the 
matching procedure request concerned was made. 
(4) In this section, "prescribed matter" means a matter specified in Schedule 5. 
(Enacted 1995) Chapter: 486 
Section: 33 Heading: 
Remarks: IPIN/1/HKGIUIl 
Page 41 
PERSONALDA!A ·ulizette Number: 
(pRJVACY)ORDfNANCE 
ProhlMtl~n again$ttransfer VerskmDate: 
of personal data to pla:c~ 
outside Hong Kong except 
in specified circumstances 
not yet in operation 
(1) This section shall not apply to personal data other than personal data the collection, holding, 
processing or use of which-
(a) takes place in Hong Kong; or 
(b) is controlled by a data user whose principal place of business is in Hong Kong. 
(2) A data user shall not transfer personal data to a place outside Hong Kong unless-
(a) the place is specified for the purposes of this section in a notice under subsection (3); 
(b) the user has reasonable grounds for believing that there is in force in that place any law 
which is substantially similar to, or serves the same purposes as, this Ordinance; 
(c) the data subject has consented in writing to the transfer; 
(d) the user has reasonable grounds for believing that, in all the circumstances of the case-
(i) the transfer is for the avoidance or mitigation of adverse action against the data 
subject; 
(ii) it is not practicable to obtain the consent in writing of the data subject to that transfer; 
and 
(iii) if it was practicable to obtain such consent, the data subject would give it; 
(e) the data are exempt from data protection principle 3 by virtue of an exemption under Part 
VIII; or 
(t) the user has taken all reasonable precautions and exercised all due diligence to ensure that 
the data will not, in that place, be collected, held, processed or used in any manner which, if 
that place were Hong Kong, would be a contravention of a requirement under this 
Ordinance. 
(3) Where the Commissioner has reasonable grounds for believing that there is in force in a place 
outside Hong Kong any law which is substantially similar to, or serves the same purposes as, this Ordinance, 
he may, by notice in the Gazette, specifY that place for the purposes of this section. 
(4) Where the Commissioner has reasonable grounds for believing that in a place specified in a notice 
under subsection (3) there is no longer in force any law which is substantially similar to, or serves the same 
purposes as, this Ordinance, he shall, either by repealing or amending that notice, cause that place to cease 
to be specified for the purposes of this section. 
(5) For the avoidance of doubt, it is hereby declared that-
(a) for the purposes of subsection (l)(b), a data user which is a company incorporated in Hong 
Kong is a data user whose principal place of business is in Hong Kong; 
(b) a notice under subsection (3) is subsidiary legislation; and 
( c) this section shall not operate to prejudice the generality of section 50. 
(Enacted 1995) IP/NIl/HKGIUIl 
Page 42 
48Q 
Section: 34 PcRSONALDATA 
(pRIVACY)ORDfNANCE 
Use-ofpetsonaldata in 
direct marketing Version Date: 30!06i1997 
shall-(1) A data user who-
Ca) has obtained personal data from any source (including the data subject); and 
(b) uses the data for direct marketing purposes, 
Ci) the first time he so uses those data after this section comes into operation, inform the data 
subject that the data user is required, without charge to the data subject, to cease to so use 
those data if the data subject so requests; 
(ii) if the data subject so requests, cease to so use those data without charge to the data subject. 
(2) In this section-
"direct marketing" means-
(a) the offering of goods, facilities or services; 
(b) the advertising of the availability of goods, facilities or services; or 
(c) the solicitation of donations or contributions for charitable, cultural, philanthropic, 
recreational, political or other purposes, 
by means of-
(i) information or goods sent to any person by mail, facsimile transmission, electronic mail, or 
other similar means of communication, where the information or goods are addressed to a 
specific person or specific persons by name; or 
(ii) telephone calls made to specific persons. 
(Enacted 1995) Chapter: 486 Title:: 
Section: 35 Heading; PERSONALI)ATA 
(pRfVACY)·ORD{N,,\NCE 
RepeatGl coll~ti().ns of 
person~ldata i.nsame 
circumstances IP/NIlIHKGlU1 1 
Page 43 
(1) A data user who-
(a) has complied with the provisions of data protection principle 1(3) in respect of the collection 
of any personal data from the data subject ("first collection"); and 
(b) on any subsequent occasion again collects personal data from the data subject ("subsequent 
collection"), 
is not required to comply with those provisions in respect of the subsequent collection if, but only if-
(i) to comply with those provisions in respect of that subsequent collection would be to repeat, 
without any material difference, what was done to comply with that principle in respect of 
the first collection; and 
(ii) not more than 12 months have elapsed between the first collection and the subsequent 
collection. 
(2) For the avoidance of doubt, it is hereby declared that subsection (1) shall not operate to prevent a 
subsequent collection from becoming a first collection if, but only if, the data user concerned has complied 
with the provisions of data protection principle 1(3) in respect of the subsequent collection. 
(Enacted 1995) IP/NIlIHKGlU1 1 
Page 44 
Chapter: 486 Title: 
He.ading: Gazette Number: PER-<;ONALPATA 
(?.RlVACY)ORD1NA:.~CE 
ins:pectiQnsQfpersonal data Version Date: 
systems 
PART VII 
INSPECTIONS, COMPLAINTS AND INVESTIGATIONS 30/06/1997 
Without prejudice to the generality of section 38, the Commissioner may carry out an inspection of­
(a) any personal data system used by a data user; or 
(b) any personal data system used by a data user belonging to a class of data users, 
for the purposes of ascertaining information to assist the Commissioner in making recommendations­
(i) to-
(A) where paragraph (a) is applicable, the relevant data user; 
(B) where paragraph (b) is applicable, the class of data users to which the relevant data 
user belongs; and 
(ii) relating to the promotion of compliance with the provisions of this Ordinance, in particular 
the data protection principles, by the relevant data user, or the class of data users to which 
the relevant data user belongs, as the case may be. 
(Enacted 1995) Tide: 
Section: 37 Heading: PERS()NALDATA 
(PRIVACY) ORDiNANCE 
Complaints IJ>~/1/fIFC(J/lJ/1 
J>age 45 
Gaiette Number: 
Version Date: 30106/1997 
(1) An individual, or a relevant person on behalf of an individual, may make a complaint to the 
Commissioner about an act or practice-
(a) specified in the complaint; and 
(b) that-
(i) has been done or engaged in, or is being done or engaged in, as the case may be, by a 
data user specified in the complaint; 
(ii) relates to personal data of which the individual is or, in any case in which the data user 
is relying upon an exemption under J>art VIII, may be, the data subject; and 
(iii) may be a contravention of a requirement under this Ordinance (including section 
28(4)). 
(2) Where 2 or more individuals may each make a complaint about the same act or practice, then 
any of those individuals, or any relevant person on behalf of any of those individuals, may make such a 
complaint on behalf of all those individuals, and the provisions of this Ordinance (including subsection (1)) 
shall be construed accordingly. 
(3) A complaint shall be-
(a) in writing in the Chinese or English language; or 
(b) in such other form as the Commissioner may accept. 
(4) It shall be the duty of the Commissioner and each prescribed officer who has been employed 
under section 9(1)(a) to provide appropriate assistance to an individual, or a relevant person on behalf of an 
individual, who wishes to make a complaint and requires assistance to formulate the complaint. 
(Enacted 1995) IP/N/1/HKG/U/1 
Page 46 
Chapter: 486 
Section: 38 Title: 
Heading: PERSONAL DA'fA 
(pRIVACy)ORDrNANCE 
Investigatil)n~ by 
Commissioner Gazette NUl.nber: 
Where the Commissioner-
then-(a) receives a complaint; or 
(b) has reasonable grounds to believe that an act or practice-
(i) has been done or engaged in, or is being done or engaged in, as the case may be, by a 
data user; 
(ii) relates to personal data; and 
(Hi) may be a contravention of a requirement under this Ordinance, 
(i) where paragraph (a) is applicable, the Commissioner shall, subject to section 39, carry out 
an investigation in relation to the relevant data user to ascertain whether the act or practice 
specified in the complaint is a contravention of a requirement under this Ordinance; 
(ii) where paragraph (b) is applicable, the Commissioner may carry out an investigation in 
relation to the relevant data user to ascertain whether the act or practice referred to in that 
paragraph is a contravention of a requirement under this Ordinance. 
(Enacted 1995) Chapter; 486 TIde: 
39 IJ>~/I/fIE(Ci/lJ/l 
J>age 47 
PERSON:AL DATA 
(PRIVACY) ORDINANCE Gazette Nu.mher: 
Restrj~~iollSUlJ Version Dat~: 30/0611997 
in"~tig3ti()nsinitlatett··h)'~ 
c()mplaints . 
(1) Notwithstanding the generality of the powers conferred on the Commissioner by this Ordinance, 
the Commissioner may refuse to carry out or continue an investigation initiated by a complaint if-
(a) the complainant (or, if the complainant is a relevant person, the individual in respect of 
whom the complainant is such a person) has had actual knowledge of the act or practice 
specified in the complaint for more than 2 years immediately preceding the date on which 
the Commissioner received the complaint, unless the Commissioner is satisfied that in all the 
circumstances of the case it is proper to carry out or continue, as the case may be, the 
investigation; 
(b) the complaint is made anonymously; 
(c) the complainant cannot be identified or traced; 
(d) none of the following conditions is fulfilled in respect of the act or practice specified in the 
complaint-
(i) either-
(A) the complainant (or, if the complainant is a relevant person, the individual in 
respect of whom the complainant is such a person) was resident in Hong Kong; 
or 
(B) the relevant data user was able to control, in or from Hong Kong, the collection, 
holding, processing or use of the personal data concerned, 
at any time the act or practice was done or engaged in, as the case may be; 
(ii) the complainant (or, ifthe complainant is a relevant person, the individual in respect of 
whom the complainant is such a person) was in Hong Kong at any time the act or 
practice was done or engaged in, as the case may be; 
(iii) in the opinion of the Commissioner, the act or practice done or engaged in, as the case 
may be, may prejudice the enforcement of any right, or the exercise of any privilege, 
acquired or accrued in Hong Kong by the complainant (or, if the complainant is a 
relevant person, the individual in respect of whom the complainant is such a person); 
or 
(e) the Commissioner is satisfied that the relevant data user has not been a data user for a 
period of not less than 2 years immediately preceding the date on which the Commissioner 
received the complaint. 
(2) The Commissioner may refuse to carry out or continue an investigation initiated by a complaint if 
he is of the opinion that, having regard to all the circumstances of the case-
(a) the complaint, or a complaint of a substantially similar nature, has previously initiated an 
investigation as a result of which the Commissioner was of the opinion that there had been 
no contravention of a requirement under this Ordinance; 
(b) the act or practice specified in the complaint is trivial; 
(c) the complaint is frivolous or vexatious or is not made in good faith; or 
(d) any investigation or further investigation is for any other reason unnecessary. 
(3) Where the Commissioner refuses under this section to carry out or continue an investigation 
initiated by a complaint, he shall, as soon as practicable but, in any case, not later than 45 days after 
receiving the complaint, by notice in writing served on the complainant accompanied by a copy of 
subsection (4), inform the complainant-
(a) of the refusal; and 
(b) of the reasons for the refusal. 
(4) An appeal may be made to the Administrative Appeals Board-
(a) against any refusal specified in a notice under subsection (3); and 
(b) by the complainant on whom the notice was served (or, if the complainant is a relevant IPINI1/HKGIU11 
Page 48 
person, the individual in respect of whom the complainant is such a person, or either). 
(Enacted 1995) Chapter: 486 Title: 
H~ing: PERSONAL DATA 
(Pltl-V'ACY)ORPINANCB IP/N/1/HKGIUIl 
Page 49 
G~tte.Ntirnber: 
Canunis$ioneT~i!.Y tarry Version· Dme: 3()!O61l997 
fUll ()r c:o~tinue .. 
investiguHon initiated QY 
complaiMuotwithstanding 
withdrawal of complaint 
Where the Commissioner is of the opinion that it is in the public interest so to do, he may carry out or 
continue an investigation initiated by a complaint notwithstanding that the complainant has withdrawn the 
complaint and, in any such case, the provisions of this Ordinance shall apply to the complaint and the 
complainant as if the complaint had not been withdrawn. 
(Enacted 1995) IP/NIlIHKGlU1 1 
Page 50 
Chapter: 486 
41 Title: 
. Hea~1:il'lg; PERSONAL-DATA. 
(pRJV'ACY) ORDINANCE 
Conlml~sl()nerta inform 
relevant data user of 
inspectionar investigatioll Gazette Number.: 
Version Date: 3Q/061!997 
(1) The Commissioner shall, before carrying out an inspection or, subject to subsection (2), an 
investigation, by notice in writing served on the relevant data user, inform the data user of his intention to 
carry out the inspection or investigation, as the case may be. 
(2) The Commissioner is not required to comply with subsection (1) in the case of any investigation 
in respect of which he has reasonable grounds to believe that to so comply may prejudice the purposes of 
the investigation. 
(Enacted 1995) Chapter: 486 Ti.de: 
Section: 42 Heading: PERSONAL DATA 
(pRIVACY) ORDlNANCE Gazette Number: 
Pt)w~ rofen try an premises Version. Date: 
fa·f the purposes t)fan 
inspecti(Hl· or investigation IP/N/IIHKGIUIl 
Page 51 
30106/1997 
(1) Subject to subsections (3) and (8), the Commissioner may, for the purposes of an inspection-
(a) where the personal data system, or any part thereof, the subject of the inspection is situated 
in-
(i) non-domestic premises, enter the premises at any reasonable time; 
(ii) domestic premises, enter the premises with the consent of any person (other than a 
minor) resident therein; 
(b) carry out in the premises the inspection. 
(2) Subject to subsections (3) and (8), the Commissioner may, for the purposes of an investigation­
(a) enter any premises-
(i) occupied by the relevant data user; or 
(ii) in which is situated the personal data system, or any part thereof, used by the relevant 
data user; 
(b) carry out in the premises the investigation. 
(3) Subject to subsections (4) and (5), the Commissioner shall, not less than 14 days before 
exercising his power under subsection (1) or (2) in respect of any premises, by notice in writing served on 
the relevant data user, inform the data user-
(a) of the premises in respect of which he proposes to exercise that power; and 
(b) that the power will not be so exercised before the expiration of 14 days after service of the 
notice. 
(4) Without prejudice to the generality of subsection (5), where any domestic premises are specified 
in a notice under subsection (3) in respect of which the Commissioner proposes to exercise his power under 
subsection (2), then the Commissioner shall not exercise that power in respect of those premises unless and 
until a person (other than a minor) resident therein consents thereto before the expiration of 14 days after 
service of the notice. 
(5) The Commissioner may, pursuant to a warrant· issued under subsection (6), exercise his power 
under subsection (2) in respect of the premises specified in the warrant without complying with subsection 
(3). 
(6) A magistrate may, if satisfied by information upon oath by the Commissioner or any prescribed 
officer that there are reasonable grounds for believing that the purposes of any investigation may be 
substantially prejudiced if the Commissioner were required to comply with subsection (3) before exercising 
his power under subsection (2) in respect of any premises, issue a warrant-
(a) in the form specified in Part 1 of Schedule 6; and 
(b) in respect of those premises. 
(7) A magistrate may, if satisfied by information upon oath by the Commissioner or any prescribed 
officer that there are reasonable grounds for believing that the purposes of an investigation may be 
substantially prejudiced if the Commissioner is prevented by the operation of subsection (4) from exercising 
his power under subsection (2) in respect of any domestic premises, issue a warrant-
(a) in the form specified in Part 2 of Schedule 6; and 
(b) authorizing the Commissioner to exercise that power in respect of those premises. 
(8) The Commissioner shall not exercise his power under subsection (1) or (2) in respect of any 
premises in such a way as to unduly disrupt any operations being carried out in the premises, whether by the 
relevant data user or any other person. 
(9) Where the Commissioner exercises his power under subsection (1) or (2), the relevant data user 
shall, without charge, afford the Commissioner such facilities and assistance as the Commissioner may 
reasonably require for the purposes of the inspection or investigation concerned. 
(10) Where the Commissioner, pursuant to a warrant issued under subsection (6), exercises his power 
under subsection (2) in respect of the premises specified in the warrant, he shall produce the warrant for IPIN/1/HKGIU/1 
Page 52 
inspection by any person found in those premises who questions his authority to exercise that power in 
respect of those premises. 
(11) In this section and Schedule 6-
"domestic premises" means any premises which are constructed or intended to be used for 
habitation; 
"non-domestic premises" means any premises other than domestic premises; 
"premises" means-
(a) any building where no part of the building is separately occupied, and includes any land 
appertaining to the building; 
(b) in any other case, any part of a building which is separately occupied, and includes any land 
appertaining to such part. 
(Enacted 1995) Chapter: 486 Title: 
SectiQn: 43 Heading: PERSONAL DATA 
(PRrYACY).ORDINANCE 
Pr()c:~ingsof 
Commissioner Version Date: IP/N/lIHKGIUIl 
Page 53 
30j06/l997 
(1) Subject to the provisions of this Ordinance, the Commissioner may, for the purposes of any 
investigation-
(a) be furnished with any information, document or thing, from such persons, and make such 
inquiries, as he thinks fit; and 
(b) regulate his procedure in such manner as he thinks fit. 
(2) Any hearing for the purposes of an investigation shall be carried out in public unless-
(a) the Commissioner is of the opinion that, in all the circumstances of the case, the 
investigation should be carried out in private; or 
(b) if the investigation was initiated by a complaint, the complainant requests in writing that the 
investigation be carried out in private. 
(3) Counsel and solicitors shall not have any right of audience before the Commissioner at any 
hearing for the purposes of an investigation, but may appear before him if he thinks fit. 
(4) It shall not be necessary for the Commissioner to hold any hearing for the purposes of an 
investigation and no person shall be entitled to be heard by the Commissioner. 
(5) If at any time during the course of an investigation it appears to the Commissioner that there may 
be sufficient grounds for him to make any report or recommendation that may criticize or adversely affect 
any person he shall give to the person an opportunity to be heard. 
(Enacted 1995) IP/N/lIHKG/UIl 
Page 54 
Chapter: 486 Title: PERSONALDAfA Gazett-e N~lmool'~ 250£ 1995s~ 2 
(PRfYACf)ORDlNANC£ 
Section: 44 Heading: Evidence Version Date: 01107/1997 
Remarks: 
Amendments retroactively made-see 25 of 1998 s. 2 
(1) Subject to subsection (2) and section 45, the Commissioner may, for the purposes of any 
investigation, summon before him any person who-
(a) in the opinion of the Commissioner, is able to give any information relevant to those 
purposes; 
(b) where the investigation was initiated by a complaint, is the complainant (or, if the 
complainant is a relevant person, the individual in respect of whom the complainant is such 
a person, or both), 
and may examine any such person and require him to furnish to the Commissioner any information and to 
produce any document or thing which, in the opinion of the Commissioner, is relevant to those purposes 
and which may be in the possession or under the control of any such person. 
then-(2) Where-
(a) an investigation has been initiated by a complaint; 
(b) the complaint relates, whether in whole or in part, to personal data referred to in section 
61(1 ); 
(c) the Commissioner has, for the purposes of that investigation, under subsection (l)(a) 
summoned before him a person; and 
(d) that person asserts, in response to any requirement under subsection (1) by the 
Commissioner to furnish him with information or to produce a document or thing, that-
(i) to comply with that requirement would directly or indirectly disclose the identity of the 
individual from whom those data were collected (whether in whole or in part); or 
(ii) he is not required to comply with that requirement by virtue of any common law 
privilege, 
(i) notwithstanding any other provision of this Ordinance, the Commissioner shall not serve an 
enforcement notice on that person in relation to that requirement; 
(ii) the Commissioner may, not later than 28 days after that assertion is made known to him, 
make an application to the Court of First Instance for an order directing that person to 
comply with that requirement; (Amended 25 of 1998 s. 2) 
(iii) the Court of First Instance may make the order if, but only if, it is satisfied, having regard to 
all the circumstances (including the circumstances of the complainant), that-(Amended 25 
of 1998 s. 2) 
(A) if the act or practice specified in the complaint were proven to be a contravention of a 
requirement under this Ordinance, the contravention would be of sufficient gravity to 
warrant that person complying with the requirement referred to in paragraph Cd); 
(B) that investigation would be substantially prejudiced if the requirement referred to in 
paragraph (d) were not compiled with; 
(C) it is in the public interest, having regard to the benefit likely to accrue to that 
investigation, that the requirement referred to in paragraph (d) be complied with; and 
CD) in any case to which paragraph (d)(ii) is applicable, the common law privilege asserted 
does not apply; and 
(iv) on the hearing of the application, the Commissioner, that person and the complainant shall 
each be entitled to be heard on the application and to call, examine and cross-examine any 
witness. 
(3) Where-
Ca) a person has complied with a requirement referred to in subsection (2)(d) the subject of an 
assertion referred to in that subsection; and IP/N/I1HKGIUIl 
Page 55 
(b) the result (whether in whole or in part) ofthe investigation to which that requirement relates 
is that the Commissioner is of the opinion that the individual concerned referred to in 
subsection (2)( d)(i) has not contravened a requirement under this Ordinance in relation to 
the matter the subject ofthe complaint which initiated the investigation, 
then, notwithstanding any other provision of this Ordinance, neither the Commissioner nor any prescribed 
officer shall disclose the identity of that individual to the complainant. 
(4) The Court of First Instance may, of its own volition or on an application made to it for the 
purpose, by order reverse, vary or discharge an order made under subsection (2)(iii) or suspend the 
operation of such an order. (Amended 25 of 1998 s. 2) 
(5) Provision may be made by rules of court-
(a) with respect to applications to the Court of First Instance under subsection (2)(iii) or (4); 
(b) generally with respect to procedure before the Court of First Instance in relation to any such 
application. (Amended 25 of 1998 s. 2) 
(6) Subsection (5) is without prejudice to the generality of any existing power to make rules. 
(7) The Commissioner may administer an oath for the purposes of an examination under subsection 
(1) if he thinks fit. 
(8) It is hereby declared that-
(a) no obligation to maintain secrecy or other restriction, imposed by law, upon the disclosure of 
any information, document or other thing, that is or has been in the possession or under the 
control of any person referred to in subsection (1), shall apply to its disclosure for the 
purposes of an investigation; and 
(b) any requirement by the Commissioner that any such information, document or thing as is 
referred to in paragraph (a) be disclosed or produced for the purposes of an investigation 
shall be sufficient authority for its disclosure or production to the Commissioner. 
(9) The Commissioner may pay the reasonable expenses of complainants (including, if the 
complainant is a relevant person, the individual in respect of whom the complainant is such a person) and 
witnesses incurred during the course of an investigation. 
(Enacted 1995) IPIN/1/HKGIU/1 
Page 56 
486 
Section: 45 
Remarks: Title: 
Heading: PERSONALOATA 
(PRJVACY) OR1)fNANCE Gaz.ette Number: 25 of 1998; 34 
of 1999 
Protection of witnesses, etc. Version Date: 0110711997 
Adaptation amendments retroactively made -see 25 of 1998 s. 2; 34 of 1999 s. 3 
(1) Every person shall have the same privileges in relation to the giving of information, the answering 
of questions, and the production of documents and things, for the purposes of an investigation, as witnesses 
have in civil proceedings in the High Court but any rule of law which authorizes or requires the withholding 
of any document or thing, or the refusal to answer any question, on the ground that the disclosure of the 
document or thing or the answering of the question, as the case may be, would be injurious to the public 
interest, shall not apply in respect of any investigation. (Amended 25 of 1998 s. 2) 
(2) Except on the trial of any person for perjury in respect of his sworn testimony, or for an offence 
under this Ordinance, no statement made or answer given by that or any other person in the course of any 
investigation shall be admissible in evidence against any person, before any magistrate or in any court or at 
any inquiry or in any other proceedings, and no evidence in respect of an investigation shall be given against 
any person. 
(3) Where the giving of any information or the answering of any question or the production of any 
document or thing would involve the disclosure, without the consent of the Chief Executive, of the 
deliberations of the Executive Council, the Commissioner shall not require the information or answer to be 
given or, as the case may be, the document or thing to be produced. (Amended 34 of 1999 s. 3) 
(Enacted 1995) IP/N/1/HKGIU/1 
Page 57 
Chapter: 486 Titk: PERSONAL DATA Gazette Number; 
46 (PRlVACY}ORQlNANCE 
Comntission~r,et~. tu 
maintain secrecy VerSlon Date: 3:010611997 
(1) Subject to subsections (2) and (3), the Commissioner and every prescribed officer shall maintain 
secrecy in respect of all matters that come to their actual knowledge in the performance of their functions 
and the exercise of their powers under this Part. 
from-(2) Subsection (1) shall not operate so as to prevent the Commissioner or any prescribed officer 
( a) disclosing in the course of proceedings-
(i) for an offence under this Ordinance; and 
(ii) before any court or magistrate, 
any matter relevant to those proceedings; 
(b) reporting evidence of any crime to such authority as he considers appropriate; 
(c) disclosing to a person any matter referred to in subsection (1) which, in the opinion of the 
Commissioner or prescribed officer, may be ground for a complaint by that person. 
(3) Subject to subsection (4), the Commissioner may disclose in any report made by him under this 
Ordinance any matter that in his opinion ought to be disclosed in order to establish grounds for his findings 
and recommendations other than a matter the disclosure of which in his opinion would involve the 
disclosure of personal data that are exempt from data protection principle 6 by virtue of an exemption under 
Part VIII. 
(4) The Commissioner shall not publish a report under this Ordinance after completing an inspection 
or investigation unless-
(a) a copy of the report in the form in which it is to be published has been supplied to the 
relevant data user; 
(b) that copy is accompanied by a notice in writing inviting the data user to advise the 
Commissioner, in writing and not later than 28 days after being served with the copy, 
whether-
(i) in the opinion of the data user there is any matter in the copy the disclosure of which 
would involve the disclosure of personal data that are exempt from the provisions of 
data protection principle 6 by virtue of an exemption under Part VIII; and 
(ii) the data user objects to the disclosure of the matter; and 
(c) either-
(i) the period referred to in paragraph (b) has expired without the Commissioner receiving 
any such advice; or 
(ii) such advice is received by the Commissioner and-
(A) the Commissioner deletes from the report the matter the subject of the advice; 
or 
(B) the Commissioner decides not to delete that matter from the report and-
(I) the period referred to in subsection (6) expires without the data user 
making an appeal under that subsection against that decision; or 
(ll) such an appeal is unsuccessful or withdrawn. 
(5) Where the Commissioner makes a decision referred to in subsection (4)(c)(ii)(B), he shall serve 
on the relevant data user who gave the advice concerned a notice in writing­
(a) stating his decision; 
(b) informing the data user that he may appeal under subsection (6) against that decision; and 
(c) accompanied by a copy of this section. 
(6) An appeal may be made to the Administrative Appeals Board against a decision of the 
Commissioner referred to in subsection (4)(c)(ii)(B) by the relevant data user not later than 14 days after the 
notice under subsection (5) stating that decision has been served on the data user. 
(Enacted 1995) IP/N/IIHKGIUIl 
Page 58 
Chapter: 486 
Section: Be-ading; PERSONAL DATA 
(PRJVACY)ORUtNA:N"CE 
Persons. to bejnfi)rm~ of Version Date: 
re~lllt of: inspediQllOr 
investigation 30106/1997 
(1) Where the Commissioner has completed an inspection, he shall, in such manner and at such time 
as he thinks fit, inform the relevant data user of-
(a) the result of the inspection; 
(b) any recommendations arising from the inspection that the Commissioner thinks fit to make 
relating to the promotion of compliance with the provisions of this Ordinance, in particular 
the data protection principles, by the data user; 
(c) any report arising from the inspection that he proposes to publish under section 48; and 
(d) such other comments arising from the inspection as he thinks fit to make. 
(2) Where the Commissioner has completed an investigation, he shall, in such manner and at such 
time as he thinks fit, inform the relevant data user of-
(a) the result of the investigation; 
(b) any recommendations arising from the investigation that the Commissioner thinks fit to 
make relating to the promotion of compliance with the provisions of this Ordinance, in 
particular the data protection principles, by the· data user; 
( c) any report arising from the investigation that he proposes to publish under section 48; 
(d) whether or not he proposes to serve an enforcement notice on the data user in consequence 
of the investigation; and 
(e) such other comments arising from the investigation as he thinks fit to make. 
(3) Where the Commissioner has completed an investigation initiated by a complaint, he shall, in 
such manner and at such time as he thinks fit, inform the complainant of­
(a) the result of the investigation; 
(b) any recommendations made to the relevant data user under subsection (2)(b); 
(c) any report arising from the investigation that he proposes to publish under section 48; 
(d) any comments made by or on behalf of the relevant data user on any such 
recommendations or report; 
( e) whether or not he has served, or proposes to serve, an enforcement notice on the relevant 
data user in consequence of the investigation; 
(t) if the Commissioner has not so served, and does not propose to so serve, such enforcement 
notice, his right to obj ect thereto under subsection (4); and 
(g) such other comments arising from the investigation as he thinks fit to make. 
(4) The complainant (or, if the complainant is a relevant person, the individual in respect of whom 
the complainant is such a person, or either) may appeal to the Administrative Appeals Board against a 
decision of the Commissioner-
(a) to the effect that he has not served, and does not propose to serve, an enforcement notice 
on the relevant data user in consequence of the investigation concerned; and 
(b) of which the complainant was informed in the notice concerned under subsection (3) served 
on him. 
(Enacted 1995) Chapter: 486 Tirle~ 
Section: 48 Heading: PERSONAL DATA 
(?RJVACr}ORD1NANCE 
Reports by Commissioner Gamtw Number: 
Version Date: IP/N/lIHKGIU/1 
Page 59 
30106/1997 
(1) Subject to subsection (3), the Commissioner may, after completing an inspection where section 
36(b) is applicable, publish a report-
(a) setting out any recommendations arising from the inspection that the Commissioner thinks fit 
to make relating to the promotion of compliance with the provisions of this Ordinance, in 
particular the data protection principles, by the class of data users to which the relevant data 
user belongs; and 
(b) in such manner as he thinks fit. 
(2) Subject to subsection (3), the Commissioner may, after completing an investigation and ifhe is of 
the opinion that it is in the public interest to do so, publish a report-
(a) setting out-
(i) the result of the investigation; 
(ii) any recommendations arising from the investigation that the Commissioner thinks fit to 
make relating to the promotion of compliance with the provisions of this Ordinance, in 
particular the data protection principles, by the class of data users to which the 
relevant data user belongs; and 
(iii) such other comments arising from the investigation as he thinks fit to make; and 
(b) in such manner as he thinks fit. 
(3) Subject to subsection (4), a report published under subsection (1) or (2) shall be so framed as to 
the prevent the identity of any individual being ascertained from it. 
(4) Subsection (3) shall not apply to any individual who is-
(a) the Commissioner or a prescribed officer; 
(b) the relevant data user. 
(Enacted 1995) IPIN/1/HKGIUIl 
Page 60 
Chapter: 486 Title: 
Section: 49 Heading: PERSONAL-DATA 
(PRlV ACY)ORDINA..NCE 
Case-sinwbicb sections 47 Versi<mDate; 
and 48 shall notappty 3010611991 
Where-
then-(a) the Commissioner has completed an investigation (and whether or not the investigation was 
initiated by a complaint); 
(b) the result ofthe investigation is that the act or practice the subject of the investigation is not 
a contravention of a requirement under this Ordinance because of an exemption under Part 
VIII; and 
(c) the interest protected by that exemption would be likely to be prejudiced if sections 47 and 
48 applied in relation to the investigation, 
(i) those sections shall not apply in relation to the investigation; and 
(ii) the Commissioner shall, in such manner and at such time as he thinks fit-
(A) inform the relevant data user of the result of the investigation and such other 
comments arising from the investigation as he thinks fit; 
(B) ifthe investigation was initiated by a complaint, inform the complainant that the result 
of the investigation is that he is satisfied that the act or practice the subject of the 
investigation is not a contravention of a requirement under this Ordinance (or words to 
the like effect). 
(Enacted 1995) Chapter: 486 Title: 
Section: SO Heading: PERSONAL DATA 
(PRIVACY)ORDfNANCE 
Enforcement notices IP/N/lIHKGIUIl 
Page 61 
Gazette Number: 
Version Date: 30/0611997 
(1) Where, following the completion of an investigation, the Commissioner is of the opinion that the 
relevant data user-
(a) is contravening a requirement under this Ordinance; or 
(b) has contravened such a requirement in circumstances that make it likely that the 
contravention will continue or be repeated, 
then the Commissioner may serve on the relevant data user a notice in writing­
(i) stating that he is of that opinion; 
(ii) specifYing the requirement as to which he is of that opinion and the reasons why he is of 
that opinion; 
(iii) directing the data user to take such steps as are specified in the notice to remedy the 
contravention or, as the case may be, the matters occassioning it within such period (ending 
not earlier than the period specified in subsection (7) within which an appeal against the 
notice may be made) as is specified in the notice; and 
(iv) accompanied by a copy of this section. 
(2) In deciding whether to serve an enforcement notice the Commissioner shall consider whether the 
contravention or matter to which the notice relates has caused or is likely to cause damage or distress to any 
individual who is the data subject of any personal data to which the contravention or matter, as the case 
may be, relates. 
(3) The steps specified in an enforcement notice to remedy any contravention or matter to which the 
notice relates may be framed-
(a) to any extent by reference to any approved code of practice; 
(b) so as to afford the relevant data user a choice between different ways of remedying the 
contravention or matter, as the case may be. 
(4) Subject to subsection (5), the period specified in an enforcement notice for taking the steps 
specified in it shall not expire before the end of the period specified in subsection (7) within which an appeal 
against the notice may be made and, if such an appeal is made, those steps need not be taken pending the 
determination or withdrawal of the appeal. 
(5) If the Commissioner is of the opinion that by reason of special circumstances the steps specified 
in an enforcement notice should be taken as a matter of urgency-
(a) he may include a statement to that effect in the notice together with the reasons why he is of 
that opinion; 
(b) where such a statement is so included, subsection (4) shall not apply but the notice shall not 
require those steps to be taken before the end of the period of 7 days beginning with the 
date on which the notice was served. 
(6) The Commissioner may cancel an enforcement notice by notice in writing served on the relevant 
data user. 
(7) An appeal may be made to the Administrative Appeals Board against an enforcement notice by 
the relevant data user not later than 14 days after the notice was served. 
(8) Where the Commissioner-
( a) forms an opinion referred to in subsection (1) in respect of the relevant data user at any time 
before the completion of an investigation; and 
Cb) is also of the opinion that, by reason of special circumstances, an enforcement notice should 
be served on the relevant data user as a matter of urgency, 
he may so serve such notice notwithstanding that the investigation has not been completed and, in any such 
case-
(i) the Commissioner shall, without prejudice to any other matters to be included in such 
notice, specifY in the notice the reasons as to why he is of the opinion referred to in 
paragraph (b); and 
(ii) the other provisions of this Ordinance (including this section) shall be construed accordingly. IP/N/IIHKG/u/l 
page6~2 ____________________________________________________ ___ (Enacted 1995) Chapter: 486 Title: 
Section: 51 Heading: PERSONAL DATA 
(PRIVACY) ORDINANCE 
Interpretation 
PART VIII 
EXEMPTIONS IP/NI1 IHKG/U/1 
Page 63 
Gazette Number: 
Version Date: 30106/1997 
Where any personal data are exempt from any provision of this Ordinance by virtue of this Part, then, 
in respect of those data and to the extent of that exemption, that provision neither confers any right nor 
imposes any requirement on any person, and the other provisions of this Ordinance which relate (whether 
directly or indirectly) to that provision shall be construed accordingly. 
(Enacted 1995) IPIN/1/HKG/U/1 
Page 64 
Cbapter: 486 
Section: 52 Title: PERSONAL DA.TA 
(PRIVACY) ORl)fNANCE 
Heading: Domestic purposes 
Personal data held by an individual and-Gaz;(!o~Numbel;: 
Version Date: 30/0611997 
(a) concerned only with the management of his personal, family or household affairs; or 
(b) so held only for recreational purposes, 
are exempt from the provisions of the data protection principles, Parts IV and V and sections 36 and 38(b). 
(Enacted 1995) Chapter: Titk: 
Section: 53 Heading: P6RSON':t\L.DATA 
(PRIVACY) ORDINAl'ZCE 
Employment -staff planning Version Date: IPINIl/HKGIUIl 
Page 65 
30106/1997 
Personal data which consist of information relevant to any staff planning proposal to-
(a) fill any series of positions of employment which are presently, or may become, unfilled; or 
(b) cease any group of individuals' employment, 
are exempt from the provisions of data protection principle 6 and section 18(1)(b). 
(Enacted 1995) IP/N/1/HKGIU/1 
Page 66 
Chapter: 486 Title: PERSONAL DATA G-.azette Number: 
(pRlV AC'OORDINANCE 
Section: 54 Heading: Em:pl~ymcnt -·tra'nsitioRal VerskmD<~te: 
provisitHls 
Cl) Personal data-
(a) held by a data user-
(i) immediately before the appointed day; 
CH) who is the employer of the data subject; and 
(Hi) relating to the employment of the subject; and 30;06/1991 
(b) provided by an individual on the implicit or explicit condition that the subject would not have 
access to the data, 
are exempt from the provisions of data protection principle 6 and section 18(1 )(b) until the expiration of 7 
years immediately following the enactment of this Ordinance. 
(2) Personal data-
(a) to which subsection (1)(a) applies; or 
Cb) held by a data user-
(i) but not so held at any time before the appointed day; 
(H) who is the employer of the data subject; and 
(iii) relating to the employment of the subject, 
are exempt from the provisions of data protection principle 6 and section 18( 1 )(b) until 1 July 1996. 
(Enacted 1995) Chapter: 486 Titie: 
Section: 55 Heading: PERSONALDATA 
(PRlVACY}ORDlNANCE 
Relevant process IP/N/l/HKG/U/l 
Page 67 
Ga7~tte Number: 
Version Date: 30106/1997 
(1) Personal data the subject of a relevant process are exempt from the provisions of data protection 
principle 6 and section 18(1 )(b) until the completion of that process. 
(2) In this section-
"completion", in relation to a relevant process, means the making of the determination concerned 
referred to in paragraph (a) of the definition of "relevant process"; 
"relevant process"-
(a) subject to paragraph (b), means any process whereby personal data are considered by one 
or more persons for the purpose of determining, or enabling there to be determined-
(i) the suitability, eligibility or qualifications ofthe data subject for­
(A) employment or appointment to office; 
(B) promotion in employment or office or continuance in employment or office; 
(C) removal from employment or office; or 
(D) the awarding of contracts, awards (including academic and professional 
qualifications), scholarships, honours or other benefits; 
(ii) whether any contract, award (including academic and professional qualifications), 
scholarship, honour or benefit relating to the data subject should be continued, 
modified or cancelled; or 
(iii) whether any disciplinary action should be taken against the data subject for a breach 
of the terms of his employment or appointment to office; 
Cb) does not include any such process where no appeal, whether under an Ordinance or 
otherwise, may be made against any such determination. 
(Enacted 1995) IP/N/lIHKGIU/1 
Page 68 
Chapter: 486 Title: PERSONA-LDATA Gaz.ette Number: 
(PRJVACY) ORI)fNANCE 
Section: 56 Heading: Personal references Version Date: 3010611997 
Personal data held by a data user which consist of a personal reference-
(a) given by an individual other than in the ordinary course of his occupation; and 
(b) relevant to another individual's suitability or otherwise to fill any position of employment or 
office which is presently, or may become, unfilled, 
are exempt from the provisions of data protection principle 6 and section 18(1)(b)-
(i) in any case, unless the individual referred to in paragraph (a) has informed the data user in 
writing that he has no objection to the reference being seen by the individual referred to in 
paragraph (b) (or words to the like effect); or 
(ii) in the case of a reference given on or after the day on which this section comes into 
operation, until the individual referred to in paragraph (b) has been informed in writing that 
he has been accepted or rejected to fill that position or office (or words to the like effect), 
whichever first occurs. 
(Enacted 1995) Chapter: 486 Tide: PERSON",,\.LDATA 
waWACY) ORDtNANCB IP/N/lIHKGIUIl 
Page 69 
Gal..ette Num~r; LN, 36201' 
1997;34 of 
1999 
Section: 51 Heading: Se(!urity.etc.in r~pect of Version Date: Otf07!l997 
Hong Kong 
Remarks: 
Adaptation amendments retroactively made -see 34 of 1999 s. 3 
(1) Personal data held by or on behalf of the Government for the purposes of safeguarding security, 
defence or international relations in respect of Hong Kong are exempt from the provisions of data protection 
principle 6 and section 18(l)(b) where the application of those provisions to the data would be likely to 
prejudice any of the matters referred to in this subsection. 
(2) Personal data are exempt from the provisions of data protection principle 3 in any case in which­
(a) the use of the data is for any of the purposes referred to in subsection (1) (and whether or 
not the data are held for any of those purposes); and 
(b) the application of those provisions in relation to such use would be likely to prejudice any of 
the matters referred to in that subsection, 
and in any proceedings against any person for a contravention of any of those provisions it shall be a 
defence to show that he had reasonable grounds for believing that failure to so use the data would have been 
likely to prejudice any of those matters. 
(3) Any question whether an exemption under subsection (1) is or at any time was required in 
respect of any personal data may be determined by the Chief Executive or Chief Secretary for 
Administration; and a certificate signed by the Chief Executive or Chief Secretary for Administration 
certifYing that the exemption is or at any time was so required shall be evidence of that fact. (Amended 
L.N. 362 of 1997; 34 of 1999 s. 3) 
(4) For the purposes of subsection (2), a certificate signed by the Chief Executive or Chief Secretary 
for Administration certifYing that personal data are or have been used for any purpose referred to in 
subsection (1) shall be evidence of that fact. (Amended L.N. 362 of 1997; 34 of 1999 s. 3) 
(5) The Chief Executive or Chief Secretary for Administration may, in a certificate referred to in 
subsection (3) or (4), in respect of the personal data to which the certificate relates and for the reasons 
specified in that certificate, direct the Commissioner not to carry out an inspection or investigation and, in 
any such case, the Commissioner shall comply with the direction. (Amended L.N. 362 of 1997; 34 of 1999 
s. 3) 
(6) A document purporting to be a certificate referred to in subsection (3) or (4) shall be received in 
evidence and, in the absence of evidence to the contrary, shall be deemed to be such a certificate. 
(7) In this section-
"international relations" includes relations with any international organization; 
"security" includes the prevention or preclusion of persons (including persons detained in 
accordance with the provisions of the Immigration Ordinance (Cap 115» entering and remaining in 
Hong Kong who do not have the right to enter and remain in Hong Kong. 
(Enacted 1995) IP/N/lIHKG/U/I 
Page 70 
Chapter: 486 Tit!:e: PERSONAL DATA Ga;m1t~Number; LN. 70·of 
(PRJVACy)·ORDINANCE 1999 
Section: 58 Heading: Crime, etc. Version Date: 03/08/1999 
(1) Personal data held for the purposes of­
(a) the prevention or detection of crime; 
(b) the apprehension, prosecution or detention of offenders; 
(c) the assessment or collection of any tax or duty; 
(d) the prevention, preclusion or remedying (including punishment) of unlawful or seriously 
improper conduct, or dishonesty or malpractice, by persons; 
(e) the prevention or preclusion of significant financial loss arising from-
(i) any imprudent business practices or activities of persons; or 
(ii) unlawful or seriously improper conduct, or dishonesty or malpractice, by persons; 
(f) ascertaining whether the character or activities of the data subject are likely to have a 
significantly adverse impact on any thing-
(i) to which the discharge of statutory functions by the data user relates; or 
(H) which relates to the discharge of functions to which this paragraph applies by virtue of 
subsection (3); or 
(g) discharging functions to which this paragraph applies by virtue of subsection (3), 
are exempt from the provisions of data protection principle 6 and section 18(1)(b) where the application of 
those provisions to the data would be likely to-
(i) prejudice any of the matters referred to in this subsection; or 
(ii) directly or indirectly identify the person who is the source of the data. 
(2) Personal data are exempt from the provisions of data protection principle 3 in any case in which­
(a) the use of the data is for any of the purposes referred to in subsection (1) (and whether or 
not the data are held for any of those purposes); and 
(b) the application of those provisions in relation to such use would be likely to prejudice any of 
the matters referred to in that subsection, 
and in any proceedings against any person for a contravention of any of those provisions it shall be a 
defence to show that he had reasonable grounds for believing that failure to so use the data would have been 
likely to prejudice any of those matters. 
(3) Paragraphs (f)(ii) and (g) of subsection (1) apply to any functions of a financial regulator­
(a) for protecting members ofthe public against financial loss arising from-
(i) dishonesty, incompetence, malpractice or seriously improper conduct by persons-
(A) concerned in the provision of banking, insurance, investment or other financial 
services; 
(B) concerned in the management of companies; 
(BA) concerned in the administration of provident fund schemes registered under the 
Mandatory Provident Fund Schemes Ordinance (Cap 485); (Added 4 of 1998 s. 
14) 
(C) concerned in the management of occupational retirement schemes within the 
meaning of the Occupational Retirement Schemes Ordinance (Cap 426); or 
(D) who are shareholders in companies; or 
(ii) the conduct of discharged or undischarged bankrupts; 
(b) for maintaining or promoting the general stability or effective working of any of the systems 
which provide any of the services referred to in paragraph (a)(i)(A); or 
(c) specified for the purposes of this subsection in a notice under subsection (4). 
(4) For the purposes of subsection (3), the Chief Executive may, by notice in the Gazette, specify a 
function of a financial regulator. (Amended 34 of 1999 s. 3) 
(5) It is hereby declared that-
(a) subsection (3) shall not operate to prejudice the generality of the operation of paragraphs 
(a), (b), (c), (d) and (f)(i) of subsection (1) in relation to a financial regulator; 
(b) a notice under subsection (4) is subsidiary legislation. IP/N/1IHKG/U/1 
Page 71 
(Enacted 1995) IP/NIl/HKGIUIl 
Page 72 
486 
Section: 59 title: 
Heading: PERSONAL DATA 
(PRlVACY)ORDINAi~CE 
Health Version Date: 30/0611997 
Personal data relating to the physical or mental health of the data subject are exempt from the 
provisions of either or both of-
(a) data protection principle 6 and section 18(1)(b); 
(b) data protection principle 3, 
in any case in which the application of those provisions to the data would be likely to cause serious harm to 
the physical or mental health of-
(i) the data subject; or 
(ii) any other individual. 
(Enacted 1995) Chapter. 486 Title: 
Section: 60 Heading: PERSONAL DATA 
(pRWACY)·ORPINANCE 
Legal professional privilege Version Date: IP/N/lIHKG/U!1 
Page 73 
30106/1997 
Personal data are exempt from the provisions of data protection principle 6 and section 18( l)(b) if the 
data consist of information in respect of which a claim to legal professional privilege could be maintained in 
law. 
(Enacted 1995) IP /N/lIHKGIU 11 
Page 74 
Chapter: 486 
Section: 61 Thie: 
Heading: PERSQNACDATA 
(PRfVACYJ.ORDiNANCE 
News OazetteNumber: 
Version Date: 30106/1997 
(1) Personal data held by a data user-
(a) whose business, or part of whose business, consists of a news activity; and 
(b) solely for the purpose of that activity (or any directly related activity), 
are exempt from the provisions of-
(i) data protection principle 6 and sections 18(1)(b) and 38(i) unless and until the data are 
published or broadcast (wherever and by whatever means); 
(ii) sections 36 and 38(b). 
(2) Personal data are exempt from the provisions of data protection principle 3 in any case in which­
( a) the use of the data consists of disclosing the data to a data user referred to in subsection (1); 
and 
(b) such disclosure is made by a person who has reasonable grounds to believe (and reasonably 
believes) that the publishing or broadcasting (wherever and by whatever means) of the data 
(and whether or not they are published or broadcast) is in the public interest. 
(3) In this section-
"news activity" means any journalistic activity and includes-
(a) the-
(i) gathering of news; 
(ii) preparation or compiling of articles or programmes concerning news; or 
(iii) observations on news or current affairs, 
for the purpose of dissemination to the public; or 
(b) the dissemination to the public of-
(i) any article or programme of or concerning news; or 
(ii) observations on news or current affairs. 
(Enacted 1995) Chapte:t! 486 Thle: 
Section: 62 Heading: PERSONAL DATA 
(pRlVAC\() ORDINANCE 
Statistics and research Version Date: IPIN/1/HKGIU/1 
Page 75 
30106/1997 
Personal data are exempt from the provisions of data protection principle 3 where­
(a) the data are to be used for preparing statistics or carrying out research; 
(b) the data are not to be used for any other purpose; and 
(c) the resulting statistics or results of the research are not made available in a form which 
identifies the data subjects or any of them. 
(Enacted 1995) IP/N/1/HKGIU/1 
Page 76 
Chapter: 486 TIde: PERSONAL DAtA 
(PRlVACY) ORDlNA'iCE 
£xemptinnfrom ~dion 
18(1)(a) Version Date: 30/06/1997 
Where a data access request relates to personal data which are or, if the data existed, would be exempt 
from section 18( 1 )(b) by virtue of section 57 or 58, then the data are also exempt from section 18(1)( a) if 
the interest protected by that exemption would be likely to be prejudiced by the disclosure of the existence 
or non-existence of those data. 
(Enacted 1995) Chapter: 486 Title: 
Section: 64 Heading: PERSONAL DATA·· 
(pRIVACY) ORDINA'N'CE 
Offences 
PART IX Gazette Number: 
Version Date: 
OFFENCES AND COMPENSATION IP/N/1/HKG/UIl 
Page 77 
30/0611997 
(1) A data user who, in any-
(a) data user return submitted under section 14(4) to the Commissioner; 
(b) notice under section 14(8) served on the Commissioner; or 
(c) notice under section 15(3) or (4) submitted to or served on the Commissioner, 
knowingly or recklessly supplies any information-
(i) which is false or misleading in a material particular; and 
(ii) in purported compliance with that section, 
commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. 
(2) A person who, in any data access request or data correction request, supplies any information­
(a) which is false or misleading in a material particular; and 
(b) which is so supplied for the purpose of having the data user concerned comply with the 
request, 
commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. 
(3) A person who, in any notice under section 15(6) served on the Commissioner, supplies any 
information-
(a) which is false or misleading in a material particular; and 
(b) which is so supplied for the purpose of having the Commissioner comply with the request to 
which the notice relates, 
commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. 
(4) A data user who, in any matching procedure request submitted to the Commissioner, supplies 
any information-
(a) which is false or misleading in a material particular; and 
(b) which is so supplied for the purpose of having the Commissioner consent to the matching 
procedure to which the request relates, 
commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. 
(5) A data user (induding a data user first-mentioned in section 32(2)) who contravenes any 
condition specified in a notice under section 30(2) or 32(l)(b)(i) commits an offence and is liable on 
conviction to a fine at level 3. 
(6) Any person who contravenes section 44(3) or 46(1) commits an offence and is liable on 
conviction to a fine at level 3 and to imprisonment for 6 months. 
(7) Subject to subsection (8), any relevant data user who contravenes an enforcement notice served 
on the data user commits an offence and is liable on conviction to a fine at level 5 and to imprisonment for 
2 years and, in the case of a continuing offence, to a daily penalty of $1000. 
(8) It shall be a defence for a relevant data user charged with an offence under subsection (7) to 
show that the data user exercised all due diligence to comply with the enforcement notice concerned. 
(9) Any person who-
(a) without lawful excuse, obstructs, hinders or resists the Commissioner or any other person in 
the performance of his functions or the exercise of his powers under Part VII; 
(b) without lawful excuse, fails to comply with any lawful requirement of the Commissioner or 
any other person under that Part; or 
(c) makes a statement which he knows to be false or does not believe to be true, or otherwise 
knowingly misleads the Commissioner or any other person in the performance of his 
functions or the exercise of his powers under that Part, 
commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. 
(10) A data user who, without reasonable excuse, contravenes any requirement under this Ordinance IP/N/lIHKGIUIl 
Page 78 
(other than a contravention of a data protection principle) for which no other penalty is specified in this 
section commits an offence and is liable on conviction to a fine at level 3. 
(Enacted 1995) Chapter: 486 
Section: 65 Heading: PERSONALDATA 
(PRlVACY)ORDINk~eE 
Liability of employers ~nd Version Date: 
principals IJ>~/l/lIF(Ci/lJ/l 
J>age 79 
30/0611991 
(1) Any act done or practice engaged in by a person in the course of his employment shall be treated 
for the purposes of this Ordinance as done or engaged in by his employer as well as by him, whether or not 
it was done or engaged in with the employer's knowledge or approval. 
(2) Any act done or practice engaged in by a person as agent for another person with the authority 
(whether express or implied, and whether precedent or subsequent) of that other person shall be treated for 
the purposes of this Ordinance as done or engaged in by that other person as well as by him. 
(3) In proceedings brought under this Ordinance against any person in respect of an act or practice 
alleged to have been done or engaged in, as the case may be, by an employee of his it shall be a defence for 
that person to prove that he took such steps as were practicable to prevent the employee from doing that act 
or engaging in that practice, or from doing or engaging in, in the course of his employment, acts or practices, 
as the case may be, of that description. 
(4) For the avoidance of doubt, it is hereby declared that this section shall not apply for the purposes 
of any criminal proceedings. 
(Enacted 1995) IP/N/1/HKGIUIl 
Page 80 
Chapter: 4&6 Thle: PERSONAL DATA G-~tte Number: 
(PRWAC'{)ORDINANCE 
Section: 66 Heading: Compensation Version Date: 30/0611997 
(1) Subject to subsection (4), an individual who suffers damage by reason of a contravention­
(a) of a requirement under this Ordinance; 
(b) by a data user; and 
(c) which relates, whether in whole or in part, to personal data of which that individual is the 
data subject, 
shall be entitled to compensation from that data user for that damage. 
(2) For the avoidance of doubt, it is hereby declared that damage referred to in subsection (1) may 
be or include injuty to feelings. 
(3) In any proceedings brought against any person by virtue of this section it shall be a defence to 
show that-
(a) he had taken such care as in all the circumstances was reasonably required to avoid the 
contravention concerned; or 
(b) in any case where the contravention concerned occurred because the personal data 
concerned were inaccurate, the data accurately record data received or obtained by the data 
user concerned from the data subject or a third party. 
(4) Where an individual suffers damage referred to in subsection (1) by reason of a contravention 
referred to in that subsection which occurred because the personal data concerned were inaccurate, then no 
compensation shall be payable under that subsection in respect of so much of that damage that has occurred 
at any time before the expiration of 1 year immediately following the day on which this section commences. 
(Enacted 1995) Chapter: 486 Title: 
Section: 6·' Heading: PERSONAL DATA 
(PRIVACY)ORDINk~CE 
Power of Commj$sinner to V~rsiQnDate: 
specify forms 
PART X 
MISCELLANEOlJS IJ>~/I/fI}((J/lJ/l 
J>age 81 
30/O6l i 9;}7 
(1) Subject to subsection (2), the Commissioner may specify the form of any document required 
under this Ordinance to be in the specified form and the form of such other documents required for the 
purposes of this Ordinance as he thinks fit. 
(2) The Commissioner's power under subsection (1) shall be subject to any express requirement 
under this Ordinance for a form, whether specified or otherwise, to comply with that requirement, but that 
requirement shall not restrict the exercise of that power in respect of that form to the extent that, in the 
opinion of the Commissioner, his exercise of that power in respect of that form does not contravene that 
requirement. 
(3) The Commissioner's power under subsection (1) may be exercised in such a way as to-
(a) include in the specified form of any document referred to in that subsection a statutory 
declaration-
(i) to be made by the person completing the form; and 
(ii) as to whether the particulars contained in the form are true and correct to the best of 
that person's knowledge and belief; 
(b) specify 2 or more forms of any document referred to in that subsection, whether as 
alternatives, or to provide for particular circumstances or particular cases, as the 
Commissioner thinks fit. 
( 4) A form specified under this section shall be-
(a) completed in accordance with such directions and instructions as are specified in the form; 
Cb) accompanied by such documents as are specified in the form; and 
(c) if the completed form is required to be provided to-
(i) the Commissioner; 
(ii) another person on behalf of the Commissioner; or 
(iii) any other person, 
so provided in the manner, if any, specified in the form. 
(Enacted 1995) IPIN/1/HKGIU/1 
Page 82 
Title: 
Section: 68 Heading: PERSONAL DATAGmtte Number: 
tpRtVACY)ORDfNANCE 
Service of notices Version Date: 30/0611997 
A notice (howsoever described) which is required to be served under this Ordinance, or which may be 
served under this Ordinance, on a person (howsoever described) shall, in the absence of evidence to the 
contrary, be deemed to be so served if-
(a) in the case of an individual, it is-
(i) delivered to him; 
(ii) left at his last known address for service, or at his last known place of residence or 
business, in Hong Kong; 
(iii) sent by post to him at his last known address for service, or at his last known postal 
address, in Hong Kong; or 
(iv) sent by telex, facsimile transmission or other similar method to him at his last known 
address for service, or at his last known postal address, or at his last known place of 
residence or business, in Hong Kong; 
(b) in the case of a company, it is-
(i) given to or served on an officer of the company; 
(ii) left at the company's last known address for service, or at its last known place of 
business, in Hong Kong; 
(iii) sent by post to the company at its last known address for service, or at its last known 
postal address, in Hong Kong; or 
(iv) sent by telex, facsimile transmission or other similar method to the company at its last 
known address for service, or at its last known postal address, or at its last known 
place of business, in Hong Kong; 
(c) in the case of a partnership, it is-
(i) delivered, left or sent in accordance with paragraph (a) in respect of any partner who 
is an individual; or 
(ii) given, served, left or sent in accordance with paragraph (b) in respect of any partner 
which is a company; 
(d) in the case of a person ("attorney") holding a power of attorney under which the attorney is 
authorized to accept service in respect of another person, it is-
(i) delivered, left or sent in accordance with paragraph (a) where the attorney is an 
individual; 
(ii) given, served, left or sent in accordance with paragraph (b) where the attorney is a 
company; 
(iii) delivered, left or sent in accordance with paragraph (a) in respect of any partner who 
is an individual where the attorney is a partnership; or 
(iv) given, served, left or sent in accordance with paragraph (b) in respect of any partner 
which is a company where the attorney is a partnership. 
(Enacted 1995) Cha:ptef~ 486 Title: 
Section: 69 Heading: PERSONAL-DATA Gazette Number: 
(PRfVA<-,,\') ORDINANCE 
Regulations -fees Version Date: IP/N/lIHKGIU/1 
Page 83 
30/0611997 
(1) The Commissioner may make regulations to prescribe the fees to be paid in respect of any 
matter, service or facility in respect of which a prescribed fee is payable to the Commissioner under this 
Ordinance. 
(2) The amount of any fee prescribed in regulations made under subsection (1) shall not be limited 
by reference to the amount of administrative or other costs incurred or likely to be incurred in relation to 
providing the matter, service or facility to which such fee relates, and different fees may be so prescribed 
for the same matter, service or facility in order to provide for particular circumstances or particular cases 
specified in the regulations. 
(Enacted 1995) IP/N/lIHKG/U/1 
Page 84 
486 Title: 
Section: 70 Heading: PBRSONALDATA 
(PR1VACY) ORD1NANCE 
Regulations -general Version Date: 30106/1997 
(1) The Secretary for Home Affairs may make regulations for all or any of the following matters-
(a) the particulars to be entered in the log book of a data user, including particulars referred to in 
section 27(2)(a), (b) and 
(c); 
(b) prescribing anything that is required or permitted to be prescribed under this Ordinance. 
(2) Any regulations made under this section may-
(a) empower the Commissioner to grant exemptions from the regulations, either generally or in 
a particular case; 
(b) make different provisions for different circumstances and provide for a particular case or 
class of case; 
(c) be made so as to apply only in such circumstances as are prescribed by the regulations. 
(3) Any regulations made under this section may prescribe offences in respect of contraventions of 
the regulations, and may provide for the imposition in respect of any such offence of a fine not exceeding 
level 3 and of imprisonment for a period not exceeding 2 years and, in the case of a continuing offence, to a 
daily penalty not exceeding $1000. 
(Enacted 1995) 486 Title: 
7.1 He.ading: 
Remarks: IJ>~/1/fIF(Ci!lJ/1 
J>age 85 
PERSONAL DATA 
(PRIVACY) ORDINANCE Gazette Nu.'nber:34of 1999 
Amendment i)fSehednl~sZ, VerttionDate: 
4and6 01/07/1997 
Adaptation amendments retroactively made -see 34 of 1999 s. 3 
The Chief Executive in Council may, by notice in the Ciazette, amend Schedule 2, 4 or 6. 
(Enacted 1995. Amended 34 of 1999 s. 3) IP/N/1/HKGIUIl 
Page 86 
Chapter: 486 
Section: 72 
(Omitted as spent) Tide; 
Heading: PERSONAL DATA 
(PRIVACY) ORDlNANCE 
(Omitted as spent) Gazette Number: 
Version Date: 30106/1997 
(Enacted 1995) 486 Title: 
Section: 73 Heading: 
(Omitted as spent) PERSQNALDATA 
WRlVACY)ORDINA<~CE 
(Omitted as spent) Gazette Number: 
Version Date: IP/N/IIHKGIUIl 
Page 87 
30106/1997 
(Enacted 1995) IP/N/1/HKGIUIl 
Page 88 
486 Title:: 
ScheJule~ Heading: PERSONALDA T.A 
(PRIVACY) ORDJNA};JCE 
DATA PROn;CTlON 
PRINCIPLES Version Date: 30iQ6fl997 
[sections 2(1) & (6)] 
1. Principle I-purpose and manner of 
collection of personal data 
(1) Personal data shall not be collected unless-
(a) the data are collected for a lawful purpose directly related to a function or activity of the 
data user who is to use the data; 
(b) subject to paragraph (c), the collection of the data is necessary for or directly related to that 
purpose; and 
(c) the data are adequate but not excessive in relation to that purpose. 
(2) Personal data shall be collected by means which are-
(a) lawful; and 
(b) fair in the circumstances of the case. 
(3) Where the person from whom personal data are or are to be collected is the data subject, all 
practicable steps shall be taken to ensure that-
(a) he is explicitly or implicitly informed, on or before collecting the data, of-
(i) whether it is obligatory or voluntary for him to supply the data; and 
(ii) where it is obligatory for him to supply the data, the consequences for him if he fails 
to supply the data; and 
(b) he is explicitly informed-
(i) on or before collecting the data, of-
(A) the purpose (in general or specific terms) for which the data are to be used; and 
(B) the classes of persons to whom the data may be transferred; and 
(ii) on or before first use of the data for the purpose for which they were collected, of­
(A) his rights to request access to and to request the correction of the data; and 
(B) the name and address of the individual to whom any such request may be made, 
unless to comply with the provisions of this subsection would be likely to prejudice the purpose for which 
the data were collected and that purpose is specified in Part VIII of this Ordinance as a purpose in relation 
to which personal data are exempt from the provisions of data protection principle 6. 
2. Principle 2-accuracy and duration of retention of personal data 
(1) All practicable steps shall be taken to ensure that-
(a) personal data are accurate having regard to the purpose (including any directly related 
purpose) for which the personal data are or are to be used; 
(b) where there are reasonable grounds for believing that personal data are inaccurate having 
regard to the purpose (including any directly related purpose) for which the data are or are 
to be used-
(i) the data are not used for that purpose unless and until those grounds cease to be 
applicable to the data, whether by the rectification of the data or otherwise; or 
(ii) the data are erased; 
(c) where it is practicable in all the circumstances of the case to know that-
(i) personal data disclosed on or after the appointed day to a third party are materially 
inaccurate having regard to the purpose (including any directly related purpose) for 
which the data are or are to be used by the third party; and IPIN/lIHKGIUIl 
Page 89 
(ii) that data were inaccurate at the time of such disclosure, that the third party­
(A) is informed that the data are inaccurate; and 
(B) is provided with such particulars as will enable the third party to rectifY the data 
having regard to that purpose. 
(2) Personal data shall not be kept longer than is necessary for the fulfillment of the purpose 
(including any directly related purpose) for which the data are or are to be used. 
3. Principle 3-use of personal data 
Personal data shall not, without the prescribed consent of the data subject, be used for any purpose 
other than-
(a) the purpose for which the data were to be used at the time of the collection of the data; or 
(b) a purpose directly related to the purpose referred to in paragraph (a). 
4. Principle 4-security of personal data 
All practicable steps shall be taken to ensure that personal data (including data in a form in which 
access to or processing of the data is not practicable) held by a data user are protected against unauthorized 
or accidental access, processing, erasure or other use having particular 
regard to-
( a) the kind of data and the harm that could result if any of those things should occur; 
(b) the physical location where the data are stored; 
(c) any security measures incorporated (whether by automated means or otherwise) into any 
equipment in which the data are stored; 
(d) any measures taken for ensuring the integrity, prudence and competence of persons having 
access to the data; and 
(e) any measures taken for ensuring the secure transmission of the data. 
5. Principle 5-information to be generally available 
All practicable steps shall be taken to ensure that a person can-
(a) ascertain a data user's policies and practices in relation to personal data; 
(b) be informed of the kind of personal data held by a data user; 
(c) be informed of the main purposes for which personal data held by a data user are or are to 
be used. 
6. Principle 6-access to personal data 
A data subject shall be entitled to-
(a) ascertain whether a data user holds personal data of which he is the data subject; 
(b) request access to personal data-
(i) within a reasonable time; 
(ii) at a fee, if any, that is not excessive; 
(iii) in a reasonable manner; and 
(iv) in a form that is intelligible; 
(c) be given reasons if a request referred to in paragraph (b) is refused; 
(d) object to a refusal referred to in paragraph (c); 
(e) request the correction of personal data; 
(t) be given reasons if a request referred to in paragraph (e) is refused; and 
(g) object to a refusal referred to in paragraph (t). 
(Enacted 1995) IP/N/1IHKGIUI 1 
Page 90 
c:napter: 486 Title: PERSONAL DA'VA 
(pRlVACY) ORDINANCE Gili"~OO! Non1;ber; L.N. 362 of' 
1997 
Scheduk 
1. Resources of Commissioner FlNANCES~tTC. Of 
COMMISSIONER 
(1) The resources of the Commissioner shall consist of­
(a) all money-Version Date; 01107!1997 
[sections 5(7), 
1O(2)(c) & 71] 
(i) paid by the Government to the Commissioner and appropriated for that purpose by 
the Legislative Council; and 
(ii) otherwise provided to the Commissioner by the Government; and 
(b) all other money and property, including gifts, donations, fees, rent, interest and 
accumulations of income received by the Commissioner. 
(2) The Secretary for the Treasury may give directions in writing of a general or specific character to 
the Commissioner in relation to the amount of money which may be expended by the Commissioner in any 
financial year and the Commissioner shall comply with those directions. 
(3) For the avoidance of doubt, it is hereby declared that any remuneration or other benefit payable 
to, and any expenses of-
(a) the Commissioner; or 
(b) any person employed or engaged under section 9(1) of this Ordinance, 
shall be paid out of the resources of the Commissioner. 
2. Borrowing powers 
(1) Subject to subsection (2), the Commissioner may borrow by way of overdraft such money as he 
may require for meeting his obligations or performing his functions under this Ordinance. 
(2) The Secretary for Home Affairs may, after consulting with the Secretary for the Treasury, give 
directions in writing of a general or specific character to the Commissioner in relation to the amount of 
money which may be borrowed under subsection (1) and the Commissioner shall comply with those 
directions. 
(3) The Commissioner may with the approval of the Secretary for Home Affairs given after the 
Secretary has consulted with the Secretary for the Treasury borrow, otherwise than by way of overdraft, 
such money as he may require for meeting his obligations or performing his functions under this Ordinance. 
(4) A person lending money to the Commissioner shall not be concerned to inquire whether the 
borrowing of the money is legal or regular or whether the money raised has been properly applied and shall 
not be prejudiced by any illegality or irregularity or by misapplication or non-application of the money. 
3. Investment of surplus funds 
(1) Subject to subsection (2), the Commissioner may invest money that is not immediately required 
to be expended. 
(2) The Commissioner shall not invest money pursuant to subsection (1) except in such forms of 
investment as the Secretary for Home Affairs, after consulting with the Secretary for the Treasury, 
approves. 
(3) Subsection (1) shall not be subject to section 10(1) of this Ordinance. 4. Accounts, audit and annual report of Commissioner IPINIlIHKGIUIl 
Page 91 
(1) The Commissioner shall cause proper accounts to be kept of all his financial transactions. 
(2) The Commissioner shall, as soon as practicable after the expiry of a financial year, prepare a 
statement of the accounts of the Commissioner, which statement shall include an income and expenditure 
account and a balance sheet. 
(3) The Commissioner shall appoint an auditor who shall, as soon as practicable, audit the accounts 
required under subsection (1) and the statement of accounts required under subsection (2) and shall submit 
a report on the statement to the Commissioner. 
(4) The Commissioner shall, as soon as practicable and in any case not later than 9 months after the 
expiry of a financial year (or such further period as the Chief Secretary for Administration allows), furnish­
(a) a report on the activities of the Commissioner during that year including a general survey of 
developments, during that year, in respect of matters falling within the scope of the 
Commissioner's functions; 
(b) a copy of the statement of accounts required under subsection (2); and 
(c) the auditor's report on the statement, 
to the Chief Secretary for Administration who shall cause the same to be tabled in the Legislative Council. 
(Amended L.N. 362 of 1997) 
(5) This section shall not be subject to section 10(1) of this Ordinance. 
5. Director of Audit's examination 
(1) The Director of Audit may, in respect of any financial year, conduct an examination into the 
economy, efficiency and effectiveness with which the Commissioner has expended his resources in 
performing his functions and exercising his powers. 
(2) Subject to subsection (3), the Director of Audit shall have a right of access at all reasonable times 
to all such documents as he may reasonably require for conducting an examination under this section and 
shall be entitled to require from any person holding or being accountable for any such document such 
information and explanation as he considers reasonably necessary for that purpose. 
(3) Subsection (2) applies only to documents in the custody and control of the Commissioner. 
(4) The Director of Audit may report to the President of the Legislative Council the results of an 
examination conducted by him under this section. 
(5) Subsection (1) shall not operate to entitle the Director of Audit to question the merits of the 
policy objectives of the Commissioner. 
6. Exemption from taxation 
(1) The Commissioner shall be exempt from taxation under the Inland Revenue Ordinance (Cap 
112). 
(2) For the avoidance of doubt, it is hereby declared that subsection (1) does not apply to or in 
relation to any remuneration, benefits or expenses referred to in section 1(3) paid out of the resources ofthe 
Commissioner to the Commissioner. 
(Enacted 1995) IP/N/1/HKG/U/1 
Page 92 
Chapter: 486 
Schedule: Title: 
Heading: PERSONAL DATA 
(pRIVACY) ORDINANCE 
PRL.'K:RlSED 
INFORMATION 
1. The name and address of the data user. Ga7..ette Nmltber; 
Versi{)ttDate! 30!O611997 
[section 14(10)] 
2. A description of the kind of personal data in respect of which the data user is a data user. 
3. A description of the purpose or purposes for which the personal data referred to in item 2 are or are to 
be collected, held, processed or used by the data user. 
4. A description of any classes of persons to whom the data user discloses, intends to disclose or may 
wish to disclose the personal data referred to in item 2. 
5. The names or a description of any places outside Hong Kong to which the data user transfers, intends 
to transfer or may wish to transfer, the personal data referred to in item 2. 
6. The name and address of the individual to whom data access requests may be made to the data user. 
(Enacted 1995) Chapter: 486 Title: 
Schedule: He,ading: IP/N/lIHKGlUll 
Page 93 
PERSONAL DATA Gazette Numher: 
(PRIVACY)OROmANCE 
PROVlS1QNSOf VersionDate: 30/06!1991 
OROlNANCES[JNi)ER 
WHICHM.A1'CfffNG 
PROC£DDRESAR£ 
REQtJIRED OR 
P-ERi\>UTTED 
[sections 30(1)(d) & 71] 
(Enacted 1995) IP /N/1/HKGIU /1 
Page 94 
Chapter; 486 
Schedule: 5 Thie: 
Heading: PERSONAL DATA 
(pRIVACY)ORDtNANt£ 
PRESCRIBED MATIERS Version Date: 
1. Whether the carrying out of the matching procedure is in the public interest. 
2. The kind of personal data to be the subject of the matching procedure. 30/0611997 
[section 32(4)] 
3. The likely consequences to a data subject if the matching procedure were to result in any adverse 
action taken against the data subject. 
4. The practices and procedures, if any, that will be followed to enable a data subject to make a data 
correction request-
(a) in respect any of the personal data produced or verified by the matching procedure; 
(b) before any adverse action is taken against the data subject. 
5. The practices and procedures, if any, that will be followed to ensure, so far as is practicable, the 
accuracy of any personal data produced or verified by the matching procedure. 
6. Whether any such data subject is to be informed ofthe procedure before it is first carried out. 
7. Whether there is any practicable alternative to the matching procedure. 
8. The benefits to be derived from carrying out the matching procedure. 
(Enacted 1995) Chapter: 
Schedule: 486 
6 Heading: PERSONAt,DA.TA 
(pRIVACY) ORDINANCE 
PART 1 Version Date: IPIN/1/HKG/u/l 
Page 95 
30106/1997 
[sections 42(6), (7) & (11) & 71] 
WARRANT AUTHORIZING PRIVACY COMMISSIONER FOR PERSONAL DATA 
TO ENTER SPECIFIED PREMISES WITHOUT INFORMING 
RELEVANT DATA USER 
To the Privacy Commissioner for Personal Data. 
Having been satisfied by information upon oathldeclaration* that there are reasonable grounds for 
believing that the purposes of an investigation under the Personal Data (Privacy) Ordinance (Cap 486) in 
relation to ........................................................................... . [name of relevant data user] may be 
substantially prejudiced if you were required to comply with section 42(3) of that Ordinance before 
exercising your power under section 42(2) of that Ordinance in respect of the premises at 
............................................................................................................................................. [address 
of premises occupied by the relevant data user/in which is situated the personal data system, or any part 
thereof, used by the relevant data user*]: 
YOU ARE HEREBY AUTHORIZED, with such assistants as may be necessary, to exercise your 
power under section 42(2) of that Ordinance in respect of those premises without complying with section 
42(3) of that Ordinance provided that such power is exercised before the expiration of 14 days after the date 
on which this warrant is issued. 
Dated this ........... day of ...................... 19 .... .. 
(Signature) Magistrate 
* Delete whichever is inapplicable. 
PART 2 
WARRANT AUTHORIZING PRIVACY COMMISSIONER FOR PERSONAL DATA 
TO ENTER SPECIFIED DOMESTIC PREMISES 
To the Privacy Commissioner for Personal Data. 
Having been satisfied by information upon oath/declaration* that there are reasonable grounds for 
believing that the purposes of the investigation into ................................... [name of relevant data user] 
may be substantially prejudiced if you are prevented by the operation of section 42(4) of the Personal Data 
(Privacy) Ordinance (Cap 486) from exercising your power under section 42(2) of that Ordinance in respect 
of the domestic premises at ........................... .. 
............................................................................................................................................. [address 
of domestic premises occupied by the relevant data user/in which is situated the personal data system, or 
any part thereof, used by the relevant data user*]: IPIN/1/HKGIU/1 
Page 96 
YOU ARE HEREBY AUTHORIZED, with such assistants as may be necessary, to exercise that 
power in respect of those premises provided that such power is exercised before the expiration of 14 days 
after the date on which this warrant is issued. 
Dated this ........... day of ......................... 19 ...... . 
(Signature) Magistrate 
(Enacted 1995) 
* Delete whichever is inapplicable. 