Personal Data (Privacy) (Amendment) Ordinance 2012

Amendments to the Personal Data (Privacy) Ordinance include:

New Exemptions (effective 1 October 2012)

• Personal data held by a court, a magistrate or a judicial officer in the course of performing judicial functions is exempt from the DPPs and the provisions in the Ordinance relating to data user returns and register of data users, access to and correction of personal data, inspection of personal data systems, and investigations initiated by the Privacy Commissioner.
• Personal data relating to the identity or location of a data subject is exempt from DPP3 when its disclosure or transfer would prevent causing serious harm to the physical or mental health of the data subject or any other individual.
• Personal data in relation to a minor transferred or disclosed by the Hong Kong Police Force or the Customs and Excise Department to the minor’s parent or guardian is exempt from DPP3 when the transfer or disclosure is in the interest of the minor and will facilitate the parent or guardian to exercise proper care and guardianship of the minor.
• A new exemption from DPP3 is provided for the transfer or disclosure of personal data by a data user for the purpose of a due diligence exercise to be conducted in connection with business merger, acquisition or transfer of business.
• Personal data is exempt from DPP3 if the use of the data is required or authorized by or under law, by court orders, or required in connection with any legal proceedings in Hong Kong or for establishing, exercising or defending legal rights.
• Personal data contained in records that are transferred to the Government Records Service is exempt from DPP3 when the records are used by the Government Records Service solely for the purpose of appraising the records to decide whether they are to be preserved, or organizing and preserving the records.
• Personal data is exempt from DPP1(3) and DPP3 to facilitate identification of an individual involved in a life-threatening situation, informing the individual’s immediate family members of his situation, and the carrying out of emergency rescue operations or provision of emergency relief services.
• A data user is exempt from complying with a data access request if the data user might as a result be self-incriminated of any offence other than an offence under the Ordinance. Information disclosed by a data user in compliance with a data access request is not admissible against the data user in legal proceedings for an offence under the Ordinance.