### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

27. Log book to be kept by data user
(1) A data user shall keep and maintain a log book—
(a) for the purposes of this Part;
(b) in the Chinese or English language; and
(c) such that any particulars entered in the log book pursuant to this section are not erased therefrom before the expiration of—
(i) subject to subparagraph (ii), 4 years after the day on which they were so entered;
(ii) such longer or shorter period as may be prescribed, either generally or in any particular case, by regulations made under section 70.
(2) A data user shall in accordance with subsection (3) enter in the log book—
(a) where pursuant to section 20 the data user refuses to comply with a data access request, particulars of the reasons for the refusal;
(b) where pursuant to section 21(2) the data user does not comply with section 21(1), particulars of the prejudice that would be caused to the interest protected by the exemption concerned under Part 8 if the existence or non-existence of the personal data to which the data access request concerned relates was disclosed; (Amended 18 of 2012 s. 2)
(c) where pursuant to section 24 the data user refuses to comply with section 23(1) in relation to a data correction request, particulars of the reasons for the refusal;
(d) any other particulars required by regulations made under section 70 to be entered in the log book.
(3) The particulars required by subsection (2) to be entered by a data user in the log book shall be so entered—
(a) in the case of particulars referred to in paragraph (a) of that subsection, on or before the notice under section 21(1) is served in respect of the refusal to which those particulars relate;
(b) in the case of particulars referred to in paragraph (b) of that subsection, on or before the notice under section 21(1) is served in respect of the refusal to which those particulars relate;
(c) in the case of particulars referred to in paragraph (c) of that subsection, on or before the notice under section 25(1) is served in respect of the refusal to which those particulars relate;
(d) in the case of particulars referred to in paragraph (d) of that subsection, within the period specified in regulations made under section 70 in respect of those particulars.
(4) A data user shall—
(a) permit the Commissioner to inspect and copy the log book (or any part thereof) at any reasonable time; and
(b) without charge, afford the Commissioner such facilities and assistance as the Commissioner may reasonably require for the purposes of such inspection and copying.
(Amended E.R. 1 of 2013)

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

28. Imposition of fees by data user
(1) A data user shall not impose a fee for complying or refusing to comply with a data access request or data correction request unless the imposition of the fee is expressly permitted by this section.
(2) Subject to subsections (3) and (4), a data user may impose a fee for complying with a data access request.
(3) No fee imposed for complying with a data access request shall be excessive.
(4) Where pursuant to section 19(3)(c)(iv) or (v) or (4)(ii)(B)(II) a data user may comply with a data access request by supplying a copy of the personal data to which the request relates in one of 2 or more forms, the data user shall not, and irrespective of the form in which the data user complies with the request, impose a fee for complying with the request which is higher than the lowest fee the data user imposes for complying with the request in any of those forms.
(5) A data user may refuse to comply with a data access request unless and until any fee imposed by the data user for complying with the request has been paid.
(6) Where—
(a) a data user has complied with a data access request by supplying a copy of the personal data to which the request relates; and
(b) the data subject, or a relevant person on behalf of the data subject, requests the data user to supply a further copy of that data, (Amended 18 of 2012 s. 2)

then the data user may, and notwithstanding the fee, if any, that the data user imposed for complying with that data access request, impose a fee for supplying that further copy which is not more than the administrative and other costs incurred by the data user in supplying that further copy.

29. Service and language of certain notices
Without prejudice to the generality of section 68, where pursuant to a data access request or data correction request a data user is required to, or may, inform a requestor of any matter by notice in writing, then the requestor shall be deemed not to be so informed unless and until the requestor is served with the notice—
(a) in the language in which the request is made if that language is Chinese or English;
(b) in any other case, in the Chinese or English language as the data user thinks fit.

### Personal Data (Privacy) Ordinance 《個人資料(私隱)條例》

30. Matching procedure not to be carried out except with consent of data subject, etc.
(1) A data user shall not carry out, whether in whole or in part, a matching procedure—
(a) unless and until each individual who is a data subject of the personal data the subject of that procedure has given his prescribed consent to the procedure being carried out;
(b) unless and until the Commissioner has consented under section 32 to the procedure being carried out;
(c) unless the procedure—
(i) belongs to a class of matching procedures specified in a notice under subsection (2); and
(ii) is carried out in accordance with the conditions, if any, specified in the notice; or
(d) unless it is required or permitted under any provision of any Ordinance specified in Schedule 4.
(2) For the purposes of this section, the Commissioner may, by notice in the Gazette, specify—
(a) a class of matching procedures;
(b) subject to subsection (3), the conditions, if any, subject to which a matching procedure belonging to that class shall be carried out.
(3) The Commissioner shall, before specifying any conditions in a notice under subsection (2), consult with—
(a) such bodies representative of data users to which the conditions will apply (whether in whole or in part); and
(b) such other interested persons,

as he thinks fit.
(4) It is hereby declared that a notice under subsection (2) is subsidiary legislation.
(5) Subject to subsection (6), a data user shall not take adverse action against an individual in consequence (whether in whole or in part) of the carrying out of a matching procedure—
(a) unless the data user has served a notice in writing on the individual—
(i) specifying the adverse action it proposes to take and the reasons therefor; and
(ii) stating that the individual has 7 days after the receipt of the notice within which to show cause why that action should not be taken; and
(b) until the expiration of those 7 days.
(6) Subsection (5) shall not operate to prevent a data user from taking adverse action against an individual if compliance with the requirements of that subsection would prejudice any investigation into the commission of an offence or the possible commission of an offence.