Hong Kong Ordinances

PERSONAL DATA (PRIVACY) ORDINANCE - SECT 19

Compliance with data access request

(1) Subject to subsection (2) and sections 20 and 28(5), a data  user shall
comply with a data access request not later than 40 days after receiving the
request.

(2) A data user who is unable to comply with a data access request within the
period specified in subsection (1) shall-

   (a)  before the expiration of that period-

        (i)    by notice in writing inform the requestor that the data user is
               so unable and of the reasons why the data user is so unable;
               and

        (ii)   comply with the request to the extent, if any, that the data 
               user is able to comply with the request; and

   (b)  as soon as practicable after the expiration of that period, comply or
        fully comply, as the case may be, with the request.

(3) A copy of the personal data to be supplied by a data user in compliance
with a data access request shall-

   (a)  be supplied by reference to the data at the time when the request is
        received except that the copy may take account of-

        (i)    any processing of the data- (A) made between that time and the
               time when the copy is supplied; and (B) that would have been
               made irrespective of the receipt of the request; and

        (ii)   subject to subsection (5), any correction to the data made
               between that time and the time when the copy is supplied;

   (b)  where any correction referred to paragraph (a)(ii) has been made to
        the data, be accompanied by a notice stating that the data have been
        corrected pursuant to that paragraph (or words to the like effect);
        and

   (c)  as far as practicable, be-

        (i)    intelligible unless the copy is a true copy of a document
               which- (A) contains the data; and (B) is unintelligible on its
               face;

        (ii)   readily comprehensible with any codes used by the data user
               adequately explained; and

        (iii)  in- (A) subject to sub-subparagraph (B), the language specified
               in the request or, if no language is so specified, the language
               in which the request is made (which may be the Chinese or
               English language in either case); (B) a language other than the
               language specified in the request or, if no language is so
               specified, the language in which the request is made, if, but
               only if- (I) the language in which the data are held is not the
               language specified in the request or, if no language is so
               specified, the language in which the request is made, as the
               case may be; and (II) subject to section 20(2)(b), the copy is
               a true copy of a document which contains the data;

        (iv)   without prejudice to the generality of subparagraph (iii) but
               subject to subsection (4), be in the form, or one of the forms,
               if any, specified in the request;

        (v)    where subparagraph (iv) is not applicable, in such form as the
               data user thinks fit.

(4) Where-

   (a)  a data access request specifies the form or forms in which a copy of
        the personal data to be supplied in compliance with the request is or
        are sought; and

   (b)  the data user concerned is unable to supply the copy in that form or
        any of those forms, as the case may be, because it is not practicable
        for the data user to do so, then the data user shall-

        (i)    where there is only one form in which it is practicable for the
               data user to supply the copy, supply the copy in that form
               accompanied by a notice in writing informing the requestor that
               that form is the only form in which it is practicable for the
               data user to supply the copy;

        (ii)   in any other case- (A) as soon as practicable, by notice in
               writing inform the requestor- (I) that it is not practicable
               for the data user to supply the copy in the form or any of the
               forms, as the case may be, specified in the request; (II) of
               the forms in which it is practicable for the data user to
               supply the copy; and (III) that the requestor may, not later
               than 14 days after the requestor has received the notice,
               specify in writing one of the forms referred to in
               sub-subparagraph (II) in which the copy is to be supplied; and
               (B) as soon as practicable, supply the copy- (I) in the form
               specified in the response, if any, to the notice referred to in
               subparagraph (A); (II) if there is no such response within the
               period specified in subparagraph (A)(III), supply the copy in
               any one of the forms referred to in subparagraph (A)(II) as the
               data user thinks fit.

(5) Subparagraph (ii) of paragraph (a) and paragraph (b) of subsection (3)
shall expire on the 1st anniversary of the appointed day. (Enacted 1995)