| This is the text of the Hong Kong Personal Data (Privacy) Ordinance, with hypertext (click and jump) links to all paragraph and section cross references, and to the definitions of all terms defined in the Ordinance. For information about the conventions adopted in setting this out, please refer to the separate page. |  |
 |
 |  this part |  | |
PART IX
OFFENCES AND COMPENSATION
64. Offences
(1) A data user who, in any—
(a) data user return submitted under section 14(4) to the
Commissioner;
(b) notice under section 14(8) served on the Commissioner; or
(c) notice under section 15(3) or (4) submitted to or served on
the Commissioner,
knowingly or recklessly supplies any information—
(i) which is false or misleading in a material particular;
and
(ii) in purported compliance with that section,
commits an offence and is liable on conviction to a fine at level 3
and to imprisonment for 6 months.
(2) A person who, in any data access request or data correction
request, supplies any information—
(a) which is false or misleading in a material particular; and
(b) which is so supplied for the purpose of having the data user
concerned comply with the request,
commits an offence and is liable on conviction to a fine at level 3
and to imprisonment for 6 months.
(3) A person who, in any notice under section 15(6) served on the
Commissioner, supplies any information—
(a) which is false or misleading in a material particular; and
(b) which is so supplied for the purpose of having the
Commissioner comply with the request to which the notice
relates,
commits an offence and is liable on conviction to a fine at level 3
and to imprisonment for 6 months.
(4) A data user who, in any matching procedure request submitted
to the Commissioner, supplies any information—
(a) which is false or misleading in a material particular; and
(b) which is so supplied for the purpose of having the
Commissioner consent to the matching procedure to which the
request relates,
commits an offence and is liable on conviction to a fine at level 3
and to imprisonment for 6 months.
(5) A data user (including a data user first-mentioned in section
32(2)) who contravenes any condition specified in a notice under
section 30(2) or 32(1)(b)(i) commits an offence and is liable on
conviction to a fine at level 3.
(6) Any person who contravenes section 44(3) or 46(1) commits an
offence and is liable on conviction to a fine at level 3 and to
imprisonment for 6 months.
(7) Subject to subsection (8), any relevant data user who
contravenes an enforcement notice served on the data user commits an
offence and is liable on conviction to a fine at level 5 and to
imprisonment for 2 years and, in the case of a continuing offence, to
a daily penalty of $1,000.
(8) It shall be a defence for a relevant data user charged with
an offence under subsection (7) to show that the data user exercised
all due diligence to comply with the enforcement notice concerned.
(9) Any person who—
(a) without lawful excuse, obstructs, hinders or resists the
Commissioner or any other person in the performance of his
functions or the exercise of his powers under Part VII;
(b) without lawful excuse, fails to comply with any lawful
requirement of the Commissioner or any other person under
that Part; or
(c) makes a statement which he knows to be false or does not
believe to be true, or otherwise knowingly misleads the
Commissioner or any other person in the performance of his
functions or the exercise of his powers under that Part,
commits an offence and is liable on conviction to a fine at level 3
and to imprisonment for 6 months.
(10) A data user who, without reasonable excuse, contravenes any
requirement under this Ordinance (other than a contravention of a
data protection principle) for which no other penalty is specified in
this section commits an offence and is liable on conviction to a fine
at level 3.
65. Liability of employers and principals
(1) Any act done or practice engaged in by a person in the course
of his employment shall be treated for the purposes of this Ordinance
as done or engaged in by his employer as well as by him, whether or
not it was done or engaged in with the employer's knowledge or
approval.
(2) Any act done or practice engaged in by a person as agent for
another person with the authority (whether express or implied, and
whether precedent or subsequent) of that other person shall be
treated for the purposes of this Ordinance as done or engaged in by
that other person as well as by him.
(3) In proceedings brought under this Ordinance against any
person in respect of an act or practice alleged to have been done or
engaged in, as the case may be, by an employee of his it shall be a
defence for that person to prove that he took such steps as were
practicable to prevent the employee from doing that act or engaging
in that practice, or from doing or engaging in, in the course of his
employment, acts or practices, as the case may be, of that
description.
(4) For the avoidance of doubt, it is hereby declared that this
section shall not apply for the purposes of any criminal proceedings.
66. Compensation
(1) Subject to subsection (4), an individual who suffers damage
by reason of a contravention—
(a) of a requirement under this Ordinance;
(b) by a data user; and
(c) which relates, whether in whole or in part, to personal data
of which that individual is the data subject,
shall be entitled to compensation from that data user for that
damage.
(2) For the avoidance of doubt, it is hereby declared that damage
referred to in subsection (1) may be or include injury to feelings.
(3) In any proceedings brought against any person by virtue of
this section it shall be a defence to show that—
(a) he had taken such care as in all the circumstances was
reasonably required to avoid the contravention concerned; or
(b) in any case where the contravention concerned occurred
because the personal data concerned were inaccurate, the
data accurately record data received or obtained by the data
user concerned from the data subject or a third party.
(4) Where an individual suffers damage referred to in subsection (1)
by reason of a contravention referred to in that subsection which
occurred because the personal data concerned were inaccurate, then no
compensation shall be payable under that subsection in respect of so
much of that damage that has occurred at any time before the
expiration of 1 year immediately following the day on which this
section commences.
|  this part | | |
Contents
[Prelim. & definitions]
[Admin.] [Codes of practice]
[Returns & register]
[Data access & correction]
[Matching & transfers]
[Complaints, etc.] [Exemptions]
[Offences] [Forms, fees, etc.]
[Sched 1: Data protection principles]
[Sched 2: Finances]
[Sched 3: Prescribed information]
[Sched 4: Other ordinances]
[Sched 5: Prescribed matters]
[Sched 6: Warrants]
|
For consulting on compliance with the Personal Data (Privacy) Ordinance or creative help with business planning, information technology, project management and the Internet please contact us. |