简体中文
After releasing the "Guidance on Preparing Personal Information Collection Statement and Policy Statement" on July 29, the Office of the Privacy Commissioner for Personal Data (PCPD) on Tuesdayissuedthe "Guidance on the Use of Personal Data Obtained from the Public Domain".
The newly unveiled Guidance is aimed at helping data users comply with the requirements under the Personal Data (Privacy) Ordinance ("the Ordinance"), in particular, the Data Protection Principles.
Personal data in the public domain refers to the personal data which is publicly available and accessible. Common sources include public registers, public directories, court documents, public notices, publications and more.
Personal data, be it publicly available or not, is subject to protection under the Ordinance. In particular, DPP3 restricts the use of personal data to the original purpose for which the data collected, or a directly related purpose, unless the explicit and voluntary consent of the data subject is obtained.
Allan Chiang, the Privacy Commissioner for Personal Data advises, "The fact that a data subject's personal data can be obtained from the public domain should not be taken to mean that the data subject has given blank consent for use of his or her personal data for whatever purposes."
"The test here is whether a reasonable person in the data subject's situation would find the re-use of the data unexpected, inappropriate or otherwise objectionable, taking into account the sensitivity of the data and the context of the initial data collection," he added.
