Hong KongPersonal Data (Privacy) Ordinance, access and correction of personal data
Personal Data (Privacy) Ordinance (Cap. 486), ss. 18-19, 22-23, 26-27 and Schedule 1, principle 6
In force since .
A data subject rights rule binding public and private bodies.
- Enforcement body
- Privacy Commissioner for Personal Data
- Obligation class
- Data subject rights, Retention, Governance
As of .
What it requires
- Tell a person in writing within 40 days after receiving their data access request whether you hold their personal data, and supply a copy if you do (section 19(1)).
- If you cannot answer a data access request within 40 days, tell the requestor in writing before the period ends and answer as far as you can (section 19(2)).
- Within 40 days after receiving a data correction request, correct data you are satisfied is inaccurate, supply the requestor with the corrected data, and send it with your reasons to any third party you disclosed it to in the previous 12 months; or give reasons if you refuse, and let the requestor object to a refusal (sections 22-25 and Schedule 1, principle 6).
- Take all practicable steps to erase personal data you no longer need for the purpose it was used for, unless a law prohibits erasure or keeping it is in the public interest (section 26(1)).
- Keep a log book in Chinese or English of the reasons for refusing access or correction requests, and do not erase an entry for at least 4 years unless regulations prescribe another period (section 27).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A data user that, without reasonable excuse, contravenes a requirement of the Ordinance, such as the access, correction, erasure or log book duties, commits an offence carrying a fine at level 3 (section 64A(1)); a contravention of a data protection principle is excluded (section 64A(2)).
Penalty structure
Level 3 fine under section 64A(1) for contravening a requirement of the Ordinance without reasonable excuse.
- Rule
- Fixed only
- As of
- Currency
- HKD
- Fixed cap
- 10,000
What this law does
Section 18 lets an individual ask a data user whether it holds personal data of which they are the data subject and for a copy, and section 19 requires the data user to comply within 40 days after receiving the request.
Section 22 lets an individual who considers a supplied copy of their personal data inaccurate ask the data user to correct it, and section 23 requires a data user satisfied that the data is inaccurate to correct it within 40 days and to supply the corrected data to a third party it disclosed the data to in the previous 12 months. Principle 6 entitles a data subject to be given reasons for a refused access or correction request and to object to the refusal.
Section 26 requires a data user to take all practicable steps to erase personal data no longer required for the purpose for which it was used, unless erasure is prohibited by law or not erasing is in the public interest. Section 27 requires a data user to keep a log book recording its reasons for refusing requests and not to erase an entry for 4 years.
A data user that contravenes a requirement of the Ordinance without reasonable excuse, other than a data protection principle or a requirement with its own offence, commits an offence carrying a fine at level 3 (section 64A).
When LexLint raises it
When your app profile says your app processes personal data.