Destruction of papers containing personal data - Enquiry Case Notes

No： 0509/C/2011

Title： Destruction of papers containing personal data

Content：

　　Resident A asks: when destroying papers containing personal data, is it enough to destroy them in a shredder and later dispose of them directly in household rubbish afterwards? Are there any other points to note?

Result：

　　In the absence of detailed information about the case, which the inquirer could have provided, GPDP can only make the following response on the general requirements for personal data processing:
　　In accordance with the provisions in articles 4.1.(1), 3.1 and 3.2 of the Personal Data Protection Act, the data processing involved in this case is within the scope of regulation by the said Act, except in situations that it is processed by a natural person within the scope of exclusively personal or household activities without systematic communication or transmission.
　　According to Article 4.1.(3) of the “Personal Data Protection Act”, destroying personal data is one of the ways to process personal data. As such, it must observe the provisions of the “Personal Data Protection Act”.
　　When destroying documents containing the personal data of others, appropriate measures should be taken to protect the relevant personal data during the respective destruction process. Such measures should include a level of security compatible to the risk of the data was being processed. GPDP recommended that Resident A should develop security measures applicable to the nature of the data, in accordance with the terms of Articles 15 and 16 of the “Personal Data Protection Act”.

Reference：
Please refer to "Personal Data Protection Act", articles 3，4，15，16 .

Back

個人資料保護辦公室

Gabinete para a Protecção de Dados Pessoais

Office for Personal Data Protection

News Update