Interview Notes, a Guangzhou Processor, and a 40-Day Deadline
Harbour Health is a Hong Kong insurance broker with 600 staff. Ms Chan was interviewed for a claims adjuster role in January and was rejected. In April she submitted a data access request asking for 'all interview notes and assessor comments'. Harbour Health replied that the notes are 'internal management records', offered to provide them on payment of HK$1,500, and said it would take 'as long as necessary' because the file is split between two offices. Separately, Harbour Health outsources claims adjudication, including access to medical reports, to a processor in Guangzhou under a contract that says only that the processor must 'comply with applicable law'. In May an employee of the processor photographed three claimants' medical reports and posted screenshots on a personal social media account, where a relative of one claimant saw them. One claimant has complained to the PCPD. Harbour Health says the processor, not the broker, caused the leak, and is now planning to migrate all 600 employees' HR records to a group HR platform in Singapore.
1. How should Harbour Health respond to Ms Chan's data access request, and what is wrong with its current position?
Read the worked answer
It is personal data. Interview notes and assessor comments that identify the candidate and record opinions about her are her personal data. Calling them 'internal management records' does not engage any exemption.
The 40-day rule. A data user must comply with a data access request within 40 days after receiving it. The clock runs from receipt, not from when the file is located; splitting records between two offices is an internal logistics problem, not a ground for extension. 'As long as necessary' is itself a contravention.
Fee. The Ordinance permits a fee for complying, but it must not be excessive. HK$1,500 for copying a handful of pages looks like a barrier to access rather than cost recovery, and the PCPD treats excessive fees as an impediment to the access right.
Refusal. The exemptions in the Ordinance are narrow and purpose-specific - for example crime prevention, legal professional privilege, and certain emergency and human-resource situations. If Harbour Health believes one applies, it must say which, and give reasons, within the 40-day period; a silent delay forfeits that opportunity.
Correction. DPP6 also gives a correction right if the notes are factually inaccurate; if corrected, third parties who received the data should be notified unless it is not practicable.
Practical answer. Provide the notes with redactions only where they identify third parties, charge a reasonable copying fee, and issue a written decision with reasons. A flat refusal invites an enforcement notice and a compensation claim.
2. Who is liable for the processor's employee posting claimants' medical reports, and what did DPP4 require?
Read the worked answer
Outsourcing does not shift liability. A processor handling data solely on behalf of another party is not a data user for that data. The data user remains answerable for security, and under the Ordinance acts done by a person as the agent of a data user are attributed to the data user. Harbour Health is therefore the party exposed under DPP4, whatever the Guangzhou contract says.
What DPP4 required. All practicable steps proportionate to the sensitivity of medical data: limiting remote access to the claims system to the records actually needed, disabling bulk export and screen capture, logging and reviewing access, confidentiality undertakings for processor staff, contractual rights to audit and suspend, and an obligation to notify breaches within a defined period. A one-line 'comply with applicable law' clause satisfies none of this.
DPP3. The processor may use the data only for claims adjudication. An employee repurposing it for a personal social media post is a use inconsistent with the purpose of collection.
Response. Suspend the individual's access and the account, notify the three claimants promptly, assess whether the PCPD should be informed, review other records the employee could reach, and re-paper the contract with concrete controls. Note that the 2021 anti-doxxing offence may also be engaged by a disclosure of personal data without consent where the intent or effect is to cause harm.
3. Can Harbour Health simply move 600 employees' HR records to the Singapore group platform? What obligations apply?
Read the worked answer
Section 33 of the PDPO has never been brought into force, so there is no blanket statutory ban on exporting personal data from Hong Kong. That does not make the migration unregulated.
DPP4 still applies. The data user must take all practicable steps to protect the data. Moving 600 employees' records to a group platform requires due diligence on the recipient's security, role-based access, encryption in transit and at rest, retention, and breach notification. The PCPD's guidance on cross-border transfer treats the recommended model contractual clauses (2022) as the expected baseline, together with a transfer impact assessment.
DPP5 and DPP1. The privacy policy statement must disclose the classes of persons to whom data may be transferred and whether data is transferred outside Hong Kong. If the platform introduces a new purpose - group-wide analytics or performance scoring, for instance - DPP3 requires prescribed consent: a clear indication of the new purpose and a positive response, not merely a notice.
Data minimisation. Map which fields actually need to leave Hong Kong; health and disciplinary records should be excluded or strongly justified.
Watch the horizon. If section 33 is commenced, the cross-border transfer will become a separate prescriptive regime with data-user-to-data-user obligations, and the current arrangements will need re-papering.