XN000022-1996-12-06 — Page 4

2

"The data users must comply with such an access request unless there is an applicable exemption. For example, there is an exemption where the personal data concerned are held for the prevention or detection of crime and the compliance with the access request would prejudice this purpose," the spokesman said.

Schedule 1 of the Ordinance sets out six Data Protection Principles aimed at protecting individuals' interests. Apart from Principle 6 which specifies data subjects' rights, the others are formulated to impose obligations on data users.

Under these Principles, data users:

must not collect more data than necessary for the purposes of their activities;

must not use the data for another purpose without the data subject's consent;

must take practicable steps to ensure the accuracy of the data and to safeguard the security of the data;

must be open about the kinds of personal data they hold and the main purposes for which personal data are used.

The spokesman said the Privacy Commissioner for Personal Data, Mr Stephen Lau, has earlier recommended that while the core provisions should take effect in the latter half of December 1996, the commencement of two remaining sections of the Ordinance - which provide for specific control on the automated matching of personal data (section 30) and the transfer of personal data outside Hong Kong (section 33) - should be deferred. The Privacy Commissioner, an independent authority appointed by the Governor to administer the Ordinance, made the recommendation after consulting the Personal Data (Privacy) Advisory Committee.

"The Secretary for Home Affairs has accepted the recommendation because feedback from data users, particularly private sector organisations, indicated a need for the Privacy Commissioner to give more specific guidance on how to comply with the two sections and for data users to be allowed more time to act on such guidance," the spokesman noted.

He added that even with the deferral of the two sections that specifically control the automated matching of personal data and transfer of such data outside Hong Kong, these activities will still, with effect from December 20, 1996, be subject to the general provisions in the Ordinance. For example, the data users concerned must comply with the data protection principle that data should not be used, without the data subject's consent, for a purpose other than that for which the data were collected.

End