• we can only use personal data for the purpose for which we collected them (Principle 3);
• from the beginning, we have to say what that purpose is (Principle 1);
• in most cases, we have to let people see all the information that we hold about them within 40 days of their asking (Principle 6);
• people asking for access to their data have to prove their identity and may have to pay a fee;
• in most cases, we have to correct or delete the information, if we are told it’s wrong (Principles 2 and 6);
• we have to be careful in letting other people see data and we have to keep data secure(Principle 4);
• we have to take care in exchanging data or using data from another company;
• we have to stop sending direct marketing materials or teleselling if someone asks us to (Section 34);
• an individual who is the subject of data that we hold, can sue us in a civil case if damage results from our releasing data that we should have kept confidential or from any other breach of the Ordinance or the Data Protection Principles;
• they can also sue if damage results from inaccurate data that we hold.

Personal data tell you something about an individual. That individual must be alive, and the data must include something that allows you to work out who they are.

Personal data covered by the Ordinance include paper files, card indexes, microfilm, audio tape and video tape, as well as computer files.

Personal data only come under the control of the Ordinance if you can find a person’s record through their name or some kind of personal identifier without too much difficulty. For example, a set of insurance claims files, organised by claim number with a cross reference to policy number would not be personal data for a third party injured in an accident. Personal information about them might be there, in the claim file, but if there is no index or file that allows someone to enter the injured party’s name and find the claim easily, we do not need to report these data. If there is such an index, we do.

The only easily-accessible personal data the Ordinance doesn’t cover are those held by an individual for his or her personal, family, household or recreational use only.