Personal Data (Privacy) Ordinance

Guideline No. 3.7

Personal Data (Privacy) Ordinance

I am writing to draw your attention to the Personal Data (Privacy) Ordinance ("the Ordinance") which was enacted on 3 August 1995 and gazetted on 4 August 1995. The Ordinance is expected to commence in mid-1996, pending the appointment of a Privacy Commissioner who will be responsible for monitoring and supervision of compliance with the Ordinance.

The main objective of the Ordinance is to protect privacy with respect to personal data based on internationally recognised data protection principles. These principles provide for the fair collection, use, holding and disclosure of personal data, and for the subject of personal data to have rights of access and correction. The basic features of the Ordinance and the Data Protection Principles as set out in Schedule 1 of the Ordinance are summarised at Annexes 1 and 2 respectively. These summaries do not constitute a legal interpretation of the provisions of the Ordinance, for which appropriate legal advice should be sought where necessary.

It should be noted that section 4 of the Ordinance makes it an offence if a data user does an act, or engages in a practice, that contravenes a data protection principle unless the act or practice is required or permitted under the Ordinance.

In the light of the enactment of the Ordinance, authorized institutions should take steps to review and revise, if necessary, their policies and practices in respect of the collection, use, holding and disclosure of the personal data of customers. It is imperative to ensure that such internal policies and practices will at all times comply with the provisions of the Ordinance upon its commencement. You may wish to seek your own legal advice on the practical implications of the Ordinance on your institution's business operations.

As you are aware, the HKMA and the industry Associations have formed a Working Group to develop a Code of Banking Practice in Hong. Kong. Since the Ordinance will have significant bearing on the relationship between banks and customers, the relevant provisions of the legislation will be taken into account by the Working Group in formulating recommendations relating to the processing of customer information and the duty of confidentiality.