· 22 ·
Part III of the Bill provides for the Privacy Commissioner to approve and issue codes of practice giving guidance on compliance with the Bill. Part IV provides for the Privacy Commissioner to specify classes of data users required to submit annual returns on the kinds of personal data they hold and purposes to which the data are put. The Privacy Commissioner is required to compile such returns in a register and to provide facilities for any person to have access to the register.
Part VI of the Bill subjects the automated comparison of personal data and the transfer of personal data to places outside Hong Kong to suitable control to protect the privacy interests of subject data. It also contains provision for individuals to require the erasure of personal data used for direct marketing purposes.
Part VII of the Bill makes provision for the Privacy Commissioner to inspect personal data systems and to investigate suspected breaches of the Bill's requirements either on complaint from an individual or on the Privacy Commissioner's own initiative. It also provides for the Privacy Commissioner to be able to enter premises for an inspection or investigation, to take evidence and make reports, and where necessary to issue enforcement notices. The Bill provides for appeals against certain decisions of the Privacy Commissioner to be dealt with by the Administrative Appeals Board.
Part VIII of the Bill contains exemption provisions. A broad exemption from the requirements of the Bill is provided for personal data held for domestic purposes, which include the management of personal affairs and recreational purposes. There are several exemptions from the subject access provisions in order to ensure continued efficient and effective human resources management. For example, in relation to staff planning and personal references. In addition, there is provision for a transitional exemption from the subject access provisions for employment-related personal data provided in confidence by third parties prior to the coming into effect of the Ordinance.
Part VIII of the Bill also provides for exemption from the subject access and use limitation provisions of the Bill where their application would be likely to prejudice a variety of specified public interest purposes. Such purposes include: security, defence and international relations in respect of Hong Kong, the prevention and detection of crime, the assessment or collection of taxes and financial regulation. In essence, these provisions seek to strike a balance between the individual's right to privacy with respect to personal data and the public interests involved.