### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

14A. Verification of data user returns
(1) For the purpose of verifying the accuracy of information in a data user return or change notice, the Commissioner may, by written notice served on any of the persons specified in subsection (2), reasonably require the person—
(a) to provide any document, record, information or thing specified in the written notice; and
(b) to respond in writing to any question specified in the written notice.
(2) The persons are—
(a) the data user; and
(b) any other person whom the Commissioner has reasonable grounds to believe may be able to assist in verifying any information in the data user return or change notice.
(3) A person on whom a notice is served under subsection (1) may refuse to provide any document, record, information or thing, or any response to any question, specified in the notice, if the person is entitled or obliged under any other Ordinance to do so.
(4) If, having regard to any document, record, information or thing, or any response to any question, provided under subsection (1), the Commissioner has reasonable grounds to believe that any information in a data user return or change notice is inaccurate, the Commissioner may, by written notice, require the data user to correct the information in the data user return or change notice.
(5) Subject to subsection (3), a person on whom a notice is served under subsection (1) or (4) must comply with the requirement within such reasonable period as is specified in the notice.
(6) A person who contravenes subsection (5) commits an offence and is liable on conviction to a fine at level 3.
(7) A person who, in purported compliance with a notice under subsection (1), knowingly or recklessly provides any document, record, information or thing, or any response to any question, which is false or misleading in a material particular, commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months.
(8) A data user who, in purported compliance with a notice under subsection (4), knowingly or recklessly in a data user return or change notice supplies any information which is false or misleading in a material particular, commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months.
(Added 18 of 2012 s. 8)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

16. Inspection of register
(1) The Commissioner shall provide facilities for making the particulars contained in the register available for inspection—
(a) by any person;
(b) in visible and legible form;
(c) during ordinary office hours; and
(d) free of charge.
(2) The Commissioner shall—
(a) on receipt of an application in the specified form from a person; and
(b) on payment of the prescribed fee,

provide a copy in writing of the particulars contained in the register in respect of the data user, or the class of data users, specified in the application.

17. Register shall not limit, etc. operation of this Ordinance
(1) For the avoidance of doubt, it is hereby declared that—
(a) whether or not the register contains any particulars;
(b) any particulars contained in the register,

in respect of a data user shall not of itself—
(i) limit, restrict or qualify the operation of any of the provisions of this Ordinance (including section 2(5) and the data protection principles) in relation to the data user;
(ii) exempt the data user from the operation of any of the provisions of this Ordinance.
(2) Subsection (1) shall not prejudice the operation of any limitation, restriction, qualification or exemption provided for in the other provisions of this Ordinance.

17A. Interpretation of Part 5
Without limiting the definition of relevant person in section 2(1), in this Part—

relevant person (有關人士), in relation to an individual, also includes a person authorized in writing by the individual to make, on behalf of the individual—
(a) a data access request; or
(b) a data correction request.

(Added 18 of 2012 s. 10.Amended E.R. 1 of 2013)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

18. Data access request
(1) An individual, or a relevant person on behalf of an individual, may make a request—
(a) to be informed by a data user whether the data user holds personal data of which the individual is the data subject;
(b) if the data user holds such data, to be supplied by the data user with a copy of such data.
(2) A data access request under both paragraphs of subsection (1) shall be treated as being a single request, and the provisions of this Ordinance shall be construed accordingly.
(3) A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to the contrary, be treated as being a data access request under both paragraphs of that subsection, and the provisions of this Ordinance (including subsection (2)) shall be construed accordingly.
(4) A data user who, in relation to personal data—
(a) does not hold the data; but
(b) controls the use of the data in such a way as to prohibit the data user who does hold the data from complying (whether in whole or in part) with a data access request which relates to the data,

shall be deemed to hold the data, and the provisions of this Ordinance (including this section) shall be construed accordingly. (Amended 18 of 2012 s. 11)
(5) A person commits an offence if the person, in a data access request, supplies any information which is false or misleading in a material particular for the purposes of having the data user—
(a) inform the person whether the data user holds any personal data which is the subject of the request; and
(b) if applicable, supply a copy of the data. (Added 18 of 2012 s. 11)
(6) A person who commits an offence under subsection (5) is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 11)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

26. Erasure of personal data no longer required
(1) A data user must take all practicable steps to erase personal data held by the data user where the data is no longer required for the purpose (including any directly related purpose) for which the data was used unless— (Amended 18 of 2012 s. 17)
(a) any such erasure is prohibited under any law; or
(b) it is in the public interest (including historical interest) for the data not to be erased.
(2) For the avoidance of doubt, it is hereby declared that—
(a) a data user must take all practicable steps to erase personal data in accordance with subsection (1) notwithstanding that any other data user controls (whether in whole or in part) the processing of the data; (Amended 18 of 2012 s. 17)
(b) the first-mentioned data user shall not be liable in an action for damages at the suit of the second-mentioned data user in respect of any such erasure.