TNAG-1613-FCO40-2221-Executive-Council-of-Hong-Kong-memoranda-and-minutes-of-meet-1987 — Page 128

CONFIDENTIAL #

機密

Aministrative Guidelines

4. (i)

(ii)

(iii)

(iv)

(v)

(vi)

(vii)

Departments are advised to appoint a senior officer or a departmental body on an on-going basis to assess, authorise, monitor and review personal data protection measures in existing and new computer applications. It is suggested that departments with established computer planning committees should in- corporate this function into the planning committee's terms of reference.

Personal data collected and stored should be kept to the minimum for the purpose intended.

Consideration should be given to the need to modify existing data collection forms to specify or elaborate the purpose for such data collection.

All personal data should be kept for the minimum period of time required to fulfil the purpose intended, after which they should be purged; and if data need to be archived, the question of whether they should continue to be kept in an identifiable form should be examined, e.g. data archived for statistical information purposes need not be retained in an identifiable form.

Departments are advised to keep a register of relevant information concerning existing computer applications recording and processing personal data, including the purpose of the application, the personal data items recorded and the volume of personal records.

Both standing, ad-hoc and future requests for access to and disclosure of personal data should be carefully considered in the light of the data protection principles. Existing legislation, ordinances and regulations concerned with the collection, handling and disclosure of personal data should be carefully examined for any conflict with the data protection principles, and suitable steps should be taken to resolve any conflicts or anomalies.

(viii) Preliminary consideration should be given to devising

appropriate measures for the disclosure of personal data to a data subject. The provision of such data, if required in the future, should be accompanied by a financial charge on the data subject on a cost- recovery basis.

.....

GF 323

機密

CONFIDENTIAL ##