PDPO Data Access Request HK: Cap. 486 ss. 18-22, OPS003

Under section 18(1) of Cap. 486, an individual may ask a data user two things: whether it holds personal data about them and, if it does, for a copy. A data user is any company, bank, school, hospital or government bureau that controls the collection, holding or use of personal data, so the right runs against the public and private sectors alike. The request can come from the data subject or from a relevant person as defined in section 2: a person with parental responsibility for a minor, a person appointed by a court to manage the affairs of someone who cannot, a guardian appointed under the Mental Health Ordinance (Cap. 136), and in any other case a person authorised in writing by the data subject. The leading authority on scope is Wu Kit Ping v Administrative Appeals Board [2007] 4 HKLRD 849, where Saunders J held that the right is to personal data, not to the documents that contain it, so the data user may supply extracts rather than whole files.

The government's Code on Access to Information opens departmental records on any subject, while an access request covers only information about you. Discovery under Order 24 of the Rules of the High Court (Cap. 4A) serves litigation and is controlled by the court, and the courts have said repeatedly that the Ordinance does not extend discovery rights. An access request is also the gateway to correction, because section 22 applies where a copy of the data has been supplied in compliance with an access request.

The access and correction regime sits in Part 5 of the Personal Data (Privacy) Ordinance. Section 19(1) requires the data user to comply within 40 days of receiving the request. If it cannot, section 19(2) obliges it to explain why in writing within that period, comply as far as it can and finish as soon as practicable. Refusals come in two tiers. Section 20(1) makes refusal mandatory where the data user is not given the information it reasonably needs to verify the requester's identity or where compliance would reveal a third party's data, although section 20(2) requires redaction of the third party's identity rather than a blanket refusal. Section 20(3) allows refusal where the request is not in Chinese or English, lacks the information needed to locate the data, repeats earlier similar requests unreasonably or, under section 20(3)(e), is not made in the specified form, Form OPS003. Reasons must be notified within the same 40 days under section 21, and section 27 requires the data user to log every refusal. The PCPD specified Data Access Request Form and its explanatory notes set out each ground.

Section 28(3) lets a data user charge a fee for access provided it is not excessive, which the Administrative Appeals Board reads as limited to costs directly related to and necessary for compliance; section 28(5) allows it to wait for payment. No fee may be charged for correction. Under section 23(1), a data user satisfied that the data is inaccurate must correct it within 40 days, send you the corrected copy and inform any third party that received the data in the 12 months before the correction. Exemptions in Part 8 cut across both rights, notably section 55 for evaluative data in an ongoing relevant process, section 58 for crime prevention and section 60 for legal professional privilege. Enforcement runs through a complaint under section 37, an enforcement notice under section 50, criminal liability under section 50A for ignoring it, and compensation under section 66. Organisations manage this exposure through a written personal data protection policy for Hong Kong organisations.

Employment disputes generate more data access requests than any other context. A dismissed employee who suspects the stated reason is a pretext will want appraisal notes, disciplinary records and internal emails before the Labour Tribunal hearing, and the request often goes out alongside a reply to the employer's termination letter under the Employment Ordinance. Banking comes next: a customer refused a mortgage can ask the lender, and separately the credit reference agency, what data drove the decision.

Property is a quieter source. Landlords and agents collect HKID copies, bank statements and employment details when signing a residential tenancy agreement in Hong Kong, and a former tenant is entitled to know what is still held once the lease ends. Two edge cases deserve a flag. A parent requesting a child's school counselling records must genuinely act on the child's behalf; where the real aim is evidence for the parent's own custody case, the request falls outside section 18 and can be refused. And a family seeking a late relative's hospital records cannot use the Ordinance at all, because it protects living individuals only; access comes through the personal representative, after a grant obtained with a Hong Kong probate application pack under Cap. 10.

• The data user's particulars identify the organisation by its full registered name and address the request to its data protection officer, so the date of receipt is easy to prove.
• The requester's capacity states whether you act as the data subject or as a relevant person, with the supporting authority attached. A parent attaches the birth certificate, a representative attaches the signed written authorisation, and any HKID copy is marked for use in this request only.
• The description of the data requested narrows the request by period, department, system and data type, such as CCTV footage, call recordings or emails naming you. This drafting closes the door to a refusal under section 20(3)(b), which data users invoke against wording like "all my personal data".
• The statutory timetable recites sections 19(1), 19(2) and 21, putting the data user on notice of the 40-day limit and its duty to give reasons.
• The fee clause asks for an itemised estimate before any cost is incurred and records that the fee may not be excessive under section 28(3).
• The data correction annex lists each inaccurate entry against its correct version, attaches the evidence and invokes section 23(1)(c) so that third parties who received the wrong data are told.

Codes of practice approved under section 12 of Cap. 486 change how a request plays out by sector.

Banking and consumer credit data is governed by the Code of Practice on Consumer Credit Data. When a lender has considered a credit report, the Code expects it to tell you so and to explain how to contact the credit reference agency that supplied it. That agency is a separate data user, so it receives its own request. The bank itself keeps call recordings and relationship manager notes. Naming them in the request is the difference between a full answer and a one-page statement.

Employment records fall under the Code of Practice on Human Resource Management, which generally limits retention of a former employee's data to seven years after the employment ends and of an unsuccessful applicant's data to two years. Employers often rely on section 55 to withhold evaluative material while a promotion or disciplinary process is running. That exemption ends once the decision is made. Opinions about you recorded in an appraisal are your personal data, even when the appraiser's own name is redacted.

Healthcare providers hold the most sensitive data in the system. Section 59 allows a data user to withhold health data where disclosure would be likely to cause serious harm to the physical or mental health of the data subject or another person. A hospital cannot rely on it simply because the notes are unflattering. A copy of your clinical data is not the same as a medical report written for you, which is a separate service outside the Ordinance.

Government bureaux and departments each designate a data protection officer and publish the contact address in their privacy policy statement. Many departments state expressly that a request not made on Form OPS003 may be refused under section 20(3)(e), so the specified form matters most here. Naming the division that holds your file shortens the search considerably.

You start by naming the data user and choosing whether you are making an access request, a correction request or both. If you act for someone else, the form asks for your capacity and tells you which documents to attach. The next screen decides whether the request succeeds: you describe the data by period, department and format, and the form flags wording a data user could treat as too vague under section 20(3)(b). Delivery comes next, on paper or electronically. The final step produces a covering letter and the completed request in the structure of Form OPS003, ready in Word and PDF. Send it by a method that proves the date of receipt, because the 40 days run from that date. Keep the signed copy and proof of delivery with your other personal and family documents for Hong Kong.

The most frequent mistake is the blanket request. "Please send me all my personal data" reads as thorough, yet it hands the data user a ground for refusal under section 20(3)(b). A close second is the free form letter. Many data users will process one, but any data user may lawfully refuse a request not made in the specified form, and a refusal notified on day 39 costs you almost six weeks. Requesters also forget proof of identity, which forces a refusal under section 20(1)(a).

The other errors concern timing and scope. People lose track of the deadline and complain long after the facts, forgetting that section 39(1)(a) lets the Commissioner decline to investigate matters known to the complainant for more than two years. Others treat a partial response as final, when the data user may be relying on section 19(2) and still owes the remainder. Finally, litigants use the request as a substitute for discovery. Since Wu Kit Ping, the courts have held that the Ordinance does not extend discovery rights, so the data user owes you personal data only, and the court's own procedures remain the tool for documents.