Hong Kong Ordinances

PERSONAL DATA (PRIVACY) ORDINANCE - SECT 28

Imposition of fees by data user

(1) A data user shall not impose a fee for complying or refusing to comply
with a data access request or data correction request unless the imposition of
the fee is expressly permitted by this section.

(2) Subject to subsections (3) and (4), a data user may impose a fee for
complying with a data access request.

(3) No fee imposed for complying with a data access request shall be
excessive.

(4) Where pursuant to section 19(3)(c)(iv) or (v) or (4)(ii)(B)(II) a
data user may comply with a data access request by supplying a copy of the
personal data to which the request relates in one of 2 or more forms, the
data user shall not, and irrespective of the form in which the data  user
complies with the request, impose a fee for complying with the request which
is higher than the lowest fee the data user imposes for complying with the
request in any of those forms.

(5) A data user may refuse to comply with a data access request unless and
until any fee imposed by the data user for complying with the request has been
paid.

(6) Where-

   (a)  a data user has complied with a data access request by supplying a
        copy of the personal data to which the request relates; and

   (b)  the data subject, or a relevant person on behalf of the data  subject,
        requests the data user to supply a further copy of those data, then
        the data user may, and notwithstanding the fee, if any, that the data 
        user imposed for complying with that data access request, impose a fee
        for supplying that further copy which is not more than the
        administrative and other costs incurred by the data user in supplying
        that further copy. (Enacted 1995)