1. 1 Office of the Privacy Commissioner for Personal Data Hong Kong SAR Tony LAM Deputy Privacy Commissioner for Personal Data Briefing to Asian Data Privacy Forum Delegates March 27 2001 Privacy Commissioner’s Office, Hong Kong SAR

2. 2 Functions of the Privacy Commissioner Independent authority established to monitor & supervise compliance with the provisions of the Personal Data (Privacy) Ordinance Approve & issue codes of practice Promote awareness and understanding of, and compliance with, the provisions of the Ordinance Investigate, upon receipt of complaints, or on his own initiative, suspected breaches of requirements of the Ordinance

3. 3 PCO Organisation Privacy Commissioner for Personal Data Deputy Privacy Commissioner for Personal Data Legal Director Promotion & Training Manager Operations Division Policy Division Administration Division Legal Division Promotion & Training Division Total Establishment : 34

4. 4 Operations Division 1 Handling public enquiries –Hotline, walk-in, written Processing complaints from public –Mediation, formal investigation, enforcement Performing compliance checks –Self initiated, promote compliance Approval of matching procedures applications

5. 5 Enquiry Statistics 27%

6. 6 Complaint Statistics 28%38%

7. 7 Compliance Enforcement Inspection methodology Compliance checks –proactive approach –recommendations to promote compliance Compliance self-assessment –voluntary self-checking by data users –compliance assessment kit - checklists, guidance & training materials

8. 8 Policy Division 1 Development of guidance materials –Preparing guidance notes, fact sheets, guidelines to promote compliance Formulation of personal data privacy policies –Undertaking comparative research and drafting of position papers on personal data privacy issues Development of codes of practice –Consultation, drafting, recommendation of approval

9. 9 Promoting Compliance - Code of Practice Hong Kong Identity Card1998 Consumer Credit Data1999 Human Resource Management2000 Workplace Surveillance2001

10. 10 Privacy & Technology solutions Smart card technology –Electronic ID card, Hospital health card, Personalised Octopus card Internet and e-commerce –Digital certificate, Electronic Services Delivery Surveillance monitoring technology –Fingerscan system, use of CCTV, DNA databases –Electronic Road Pricing

11. 11 Legal Division Complaints –Preparing standard forms of documents, legal issues in each case, drafting letters of particular importance, formulation of results Appeals to Administrative Appeals Board –Preparing statement and list of documents, instructing Counsel where appropriate, appearing on behalf of Commissioner in hearing, all incidental procedural matters Court Actions –Judicial review against decision by Commissioner

12. 12 Legal Division Comments on proposed Legislation –review of proposed primary and subsidiary legislation as published in Gazette or drafts provided by Administration Review of PD(P)O –“Technical” amendments to be followed by more fundamental review General legal support to the PCO –legal advice on enquiry cases –legal support on code of practice preparation

13. 13 Major Activities - 2001 Publish draft code of practice on Workplace Surveillance for public consultation Revise guidelines on protection of personal data on the Internet to include electronic commerce Publish a legal reference as an aid to the interpretation of the PD(P)O Conduct a major overhaul of the PCO web-site