Complaint Case Notes

編號: 0005/2008/IP

標題: Posting students’ personal data

立案原因: Complaints


    Resident X was a student of a course organized by Department A and Agency B. In this course, A took care of student recruiting, and then passed the students’ data such as names and contact phone numbers, etc., to B. B disclosed the data on its notice board.
  Resident X believed that the behaviors of Department A and Agency B violated the Personal Data Protection Act, and filed a complaint with this Office (GPDP).


    In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
  According to Agency B, the above-mentioned practice was adopted to enable the teachers to contact the students at the beginning of the course, as well as for the students to know and confirm their class assignment and related matters.
  In GPDP’s opinion, Department A collected students’ personal data and passed the data to Agency B for processing, therefore they are both regarded, according to Article 4.1.(5) of the Personal Data Protection Act, as data controller.
  While the purpose of Agency B’s posting students’ personal data on its notice board to facilitate the teachers contacting their students, GPDP believed that the same purpose could well be achieved by other means. One way would be to provide the students’ contact numbers to the teachers, and inform the students of their teachers’ contact numbers when giving enrollment notices via phone, so the students could contact their teachers if necessary. There was no need to post the students’ contact information to the public. Given that Agency B had already given verbal notice to the students about their enrollment, it would suffice to indicate their names and classes to which they belong on the class schedules; there was no need to disclose more personal data than necessary. The data processing was not in compliance with Article 5.1.(3) of the Personal Data Protection Act.
  In investigation, GPDP also found that Department A and Agency B needed to improve their practice in satisfying the data subjects’ right to information.
  In summary, Agency B’s data processing might be not in compliance with Article 5.1.(3) of the Personal Data Protection Act. Although it did not constitute an administrative offence, there was room for improvement.


    GPDP sent a letter to Agency B and demanded improvement, including to its practice of posting students’ names and contact numbers on its notice board. GPDP suggested that if it was necessary to notify the students of class allotment and schedules, the disclosed data could include students’ names (or student number), without disclosing their contact numbers or other personal data at the same time.
  To protect the right to information of the data subject, this Office also suggested that Department A and Agency B prepare their own statement on personal data collection, and attach it to the application forms or rules of enrollment, so as to ensure that the data subject become aware of such information.
  Agency B followed GPDP’s instruction and made improvements.

Please refer to "Personal Data Protection Act", articles 3,4,5,10 .