Hong Kong Ordinances

PERSONAL DATA (PRIVACY) ORDINANCE - SECT 30

Matching procedure not to be carried out except with consent of data subject, etc.

PART VI

MATCHING PROCEDURES AND TRANSFERS OF PERSONAL DATA, ETC.

(1) A data user shall not carry out, whether in whole or in part, a
matching procedure-

   (a)  unless and until each individual who is a data subject of the
        personal data the subject of that procedure has given his prescribed
        consent to the procedure being carried out;

   (b)  unless and until the Commissioner has consented under section  32 to
        the procedure being carried out;

   (c)  unless the procedure-

        (i)    belongs to a class of matching procedures specified in a notice
               under subsection (2); and

        (ii)   is carried out in accordance with the conditions, if any,
               specified in the notice; or

   (d)  unless it is required or permitted under any provision of any
        Ordinance specified in Schedule 4.

(2) For the purposes of this section, the Commissioner may, by notice in the
Gazette, specify-

   (a)  a class of matching procedures;

   (b)  subject to subsection (3), the conditions, if any, subject to which a
        matching procedure belonging to that class shall be carried out.

(3) The Commissioner shall, before specifying any conditions in a notice under
subsection (2), consult with-

   (a)  such bodies representative of data users to which the conditions will
        apply (whether in whole or in part); and

   (b)  such other interested persons, as he thinks fit.

(4) It is hereby declared that a notice under subsection (2) is subsidiary
legislation.

(5) Subject to subsection (6), a data user shall not take adverse  action
against an individual in consequence (whether in whole or in part) of the
carrying out of a matching procedure-

   (a)  unless the data user has served a notice in writing on the individual-

        (i)    specifying the adverse action it proposes to take and the
               reasons therefor; and

        (ii)   stating that the individual has 7 days after the receipt of the
               notice within which to show cause why that action should not be
               taken; and

   (b)  until the expiration of those 7 days.

(6) Subsection (5) shall not operate to prevent a data user from taking
adverse action against an individual if compliance with the requirements of
that subsection would prejudice any investigation into the commission of an
offence or the possible commission of an offence. (Enacted 1995)