Features of the Ordinance 《條例》的特點
The Personal Data (Privacy) Ordinance (Cap. 486) applies to both the public and private sectors. It regulates any data user, meaning anyone who controls the collection, holding, processing or use of personal data, and it is overseen by the independent Privacy Commissioner for Personal Data. Personal data means data that relates directly or indirectly to a living individual, from which it is practicable to identify that person, and which is in a form in which access or processing is practicable. The person the data relates to is the data subject. A data user that engages a data processor (for example, an outsourced IT or document-handling firm) remains responsible for the processor's acts and should protect the data by contract or other means.
The core of the Ordinance is six Data Protection Principles (DPPs): (1) purpose and manner of collection: data must be collected for a lawful purpose directly related to the data user's functions, by lawful and fair means, must be adequate but not excessive, and the data subject must be told certain matters; (2) accuracy and duration of retention: practicable steps must be taken to keep data accurate, and data must not be kept longer than necessary for the purpose; (3) use of data: data must not be used for a new purpose without the data subject's prescribed consent; (4) security: data must be protected against unauthorised or accidental access, processing, erasure, loss or use; (5) openness: the data user must make its personal data policies and practices available; (6) access and correction: data subjects may access their data and ask for it to be corrected.
Prescribed consent means express consent given voluntarily that has not been withdrawn by notice in writing. A data subject may make a data access request or a data correction request, and the data user must generally comply within 40 days of receiving it. A fee may be charged for access, but it must not be excessive. The Ordinance also contains exemptions: for example, in specified cases a data user need not follow certain principles where doing so would be likely to prejudice the prevention or detection of crime, the protection of health or legal proceedings.
A breach of a DPP is not in itself an immediate criminal offence. The Commissioner may investigate a complaint or start an investigation without one, and may serve an enforcement notice directing the data user to remedy the breach. Failing to comply with the notice is an offence. Some conduct is an offence directly, however, such as breaching the direct marketing rules or disclosing personal data obtained from a data user without its consent (which, since the 2021 amendments, also covers doxxing). A data subject who suffers damage from a breach, including injury to feelings, may also bring a civil claim for compensation.
Insurance Applications 在保險上的應用
Collection: insurers collect large amounts of personal data, including sensitive health data, through proposal forms, claim forms and medical reports. They should collect only what is needed for underwriting, policy administration and claims. On or before collection, a Personal Information Collection Statement should tell the client the purposes (such as underwriting, claims, reinsurance and fraud prevention), the classes of persons the data may be transferred to (such as reinsurers, intermediaries, doctors and loss adjusters), whether supplying the data is obligatory or voluntary and what happens if it is not supplied, and the client's rights to access and correct the data. The client's authorisation should be obtained before medical information is requested from a doctor.
Use: data may be used only for the purposes stated at collection or directly related purposes. Any new purpose needs the client's prescribed consent. Direct marketing has its own rules. Before an insurer or intermediary uses client data to market products, it must tell the client what kinds of data will be used and what classes of products or services will be marketed, and must obtain the client's consent, which can include an indication of no objection. The first time the data is used for direct marketing, the client must be told that they can ask, free of charge, for it to stop. Giving client data to another person for direct marketing requires the client's written consent, and the penalties are heavier if the data is provided for gain.
Accuracy, retention and security: insurers should keep data such as addresses up to date, and should erase data once it is no longer needed, for example after a policy ends, a claim is closed or a proposal is declined. Intermediaries should keep proposal forms and client files secure: for example, by not leaving documents in a car, encrypting laptops and mobile devices, and shredding papers. Where data is outsourced to call centres or IT firms, it should be protected by contract. An intermediary who changes company must not take the previous insurer's client data to market the new insurer's products. The Insurance Authority's codes of conduct also require licensed intermediaries to protect client information.
Openness and access: insurers should publish a privacy policy statement. A policyholder or life insured may ask for a copy of the personal data an insurer holds about them, such as a medical report obtained at underwriting, and the insurer must generally respond within 40 days. Where the data is held to investigate a suspected fraudulent claim and disclosure would be likely to prejudice the detection of crime, however, the insurer may rely on the relevant exemption and refuse.
Practice
8 practice questions · Progress is shared with full-paper practiceLoading questions…
Keys: 1–4 to choose, Enter to check / next, ← → to move