TNAG-1613-FCO40-2221-Executive-Council-of-Hong-Kong-memoranda-and-minutes-of-meet-1987 — Page 97

GF 323

CONFIDENTIAL ##

機密

-

16.

The officers of the Social Security Field Units and the Social Security Branch are the major users of the system. But the Payments Control Section centralises and controls the transactions from all users for computer processing. Online enquiries are made via 5 terminals installed in the Payments Control Section.

Findings of the four studies

17.

The findings of the studies into these four systems are summarised below in turn of their compliance or otherwise with each of the eight principles of data protection.

First Principle - The Information shall be obtained and processed fairly and lawfully

18.

All items of information are being obtained and processed lawfully. Departments are acting in accordance with either legislation or established Government policy. Whether the information is being obtained fairly cannot be determined because of the difficulties in defining fairness. Even when the data is required by law, one may question the fairness of the law itself.

Second Principle - The information shall be held for a specified and legitimate purpose or purposes

19.

This principle is being complied with. No anomaly was found in the four studies.

Third Principle The information shall not be used or disclosed in a way incompatible with the specified purpose or purposes

20.

Here, the findings are mixed. Inland Revenue Department observes this principle strictly and no information is disclosed to other parties except as provided by the Inland Revenue Ordinance. Social Welfare Department, on the other hand, provides information to other Government Departments and voluntary agencies regularly on request.

21.

In the VALID system, a person-of-interest tag is added by the Police who will receive a notification via a computer terminal when such a person has dealings with Transport Department. Such disclosure is incompatible with the purpose for which the information on the person is collected, i.e. issue of driving and vehicle licences.

22.

In general, staff members who have access to computer data can have access to all data held on a person. This is considered not necessary and measures

4

CONFIDENTIAL

機密