The transfer of personal data among government departments - Enquiry Case Notes

No： 0432/C/2011

Title： The transfer of personal data among government departments

Content：

　　Resident X reported a problem to Department A by e-mail, and later received a reply stating that his case had been transferred to the law enforcement Agency B for them to follow up on. On the same day, Resident X received an e-mail from Agency B entitled “request for data (xxx)” (the following is an excerpt of the email), “…this Bureau will not reply to any cases involving complaints or objections via e-mail… ”, and was asked to provide this name and a valid contact address.
　　Resident X asked whether the act of transferring the case and the relevant data, including his personal e-mail address by Department A to Agency B without the consent of Resident X breach the “Personal Data Protection Act”.

Result：

　　In the absence of detailed information about the case, which the inquirer could have provided, GPDP can only make the following response on the general requirements for personal data processing:
　　In accordance with the provisions in articles 4.1.(1) and 3.1 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act.
　　The data controllers may only process personal data with legitimacy if it observes the provisions in Article 6 to 8 of the “Personal Data Protection Act”. It would have legitimacy to process the personal information, for example, if it obtained the consent of the data subject, if it were executing a legal obligation or if it were exercising its power as a public authority. In the present case, GPDP was not told the specific reasons or justifications why Department A transferred Resident X’s case and personal data, nor of its data processing policy. Therefore it was unable to ascertain whether or not its conduct violated the provisions of the “Personal Data Protection Act”.
　　According to Article 11 of the “Personal Data Protection Act”, the data subject has the right of access. He can obtain information from the data controller, for example regarding the purpose of the processing and the category of the data recipient. Therefore, Resident X may obtain the relevant information from Department A.

Reference：
Please refer to "Personal Data Protection Act", articles 3，4，6，7，8，11 .

Back

個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

News Update