Third party information
Information held for, or provided by, a third party under an explicit or
implicit understanding that it would not be further disclosed. However such
information may be disclosed with the third party’s consent, or if the public
interest in disclosure outweighs any harm or prejudice that would result.
This provision will not apply to a situation where information is
supplied pursuant to a statutory guarantee of confidentiality, as the information must
then not be disclosed and will be dealt with pursuant to paragraph 2.18 of the Code
). Examples would be information supplied pursuant to the Inland
Revenue Ordinance (Cap. 112) or the Census and Statistics Ordinance (Cap. 316).
This provision applies therefore only to information which has been
supplied voluntarily, and to information which has been supplied under a statutory
compulsion or the implication that a statutory compulsion could have been invoked
where there is no provision for confidentiality in the relevant statute.
Care must always be taken in cases which involve third party
information. Information is given to the Government in many different
circumstances by persons, corporations and organisations on the explicit or implicit
basis that such information, including its source, will be kept confidential. When the
information includes data which is personal or commercially sensitive, the provisions
of paragraph 2.15 of the Code (Privacy of the individual
) and paragraph 2.16
) may also apply.
Procedures for obtaining the consent of the relevant third party are set
out at paragraphs 1.20 - 1.23 of the Code and paragraphs 1.20.2 - 1.23.9 of these
Unless compelling public interest requires (see paragraph 2.14.10),
where confidential information is supplied voluntarily it is not proper to disclose it
without the consent of the supplier, or in some cases the third party for whom it was
received by the Government.
For information to be held in confidence it must be understood by both
parties that it was held by or provided to the Government in confidence. It will not
therefore be sufficient for the supplier of the information simply to claim
confidentiality unless the Government also accepts that the information is held on this
basis. This understanding may be explicit but often it will be implicit. It may arise
in the context of communications with professionals such as lawyers, doctors,
para-medicals, social workers, etc.
The duty to hold information in confidence will often be implied where
information is supplied or prepared for a particular purpose or sought by the
Government, as opposed to where it is volunteered. It is obviously preferable that
the basis upon which the information is held should be explicit at the time of supply or
preparation, and forms, questionnaires, etc. used for the collection of information
should therefore make this clear.
The provision will not
apply where the information is already in the
public domain, has become widely known, or is available upon inspection of a register
or another document which is open for public inspection.
This provision will
apply where the release of the information sought
would be likely to prejudice the future supply of such information and this would have
a material effect on the conduct of the department’s business.
There is no obligation to release information if such release would
render the Government liable to an action for breach of confidence unless there is an
overriding public interest in disclosure. Such cases will not be common and
generally would involve circumstances such as where the information would reveal a
risk to public health, public safety or to the environment. However, the public
interest in disclosure must be compelling and clearly override the interest in preserving
confidentiality. It would be unusual for the public interest in disclosure to be such
that it would outweigh the harm of exposing the Government to liability to pay
In view of the legal constraints that apply to the disclosure of third party
information without the consent of the supplier, departments should have regard to
any recent legal advice they have received. If in doubt specific advice should be
Information provided in confidence by a third party if disclosure to the
subject of the information would harm his or any other individual's physical
or mental health, or should only be made to him by an appropriate third
Government may frequently have information relating to a person’s
medical condition, whether the person is a civil servant, an applicant for employment,
or in other circumstances. This information should be regarded as having been
provided to the Government in confidence and may not be disclosed if disclosure
would likely cause serious harm to the physical or mental health of the subject or any
other individual. This is in line with section 59(1)(a) of the Personal Data (Privacy)
The provision will also apply to information provided by other
professionals such as para-medical workers or social workers if disclosure to the
subject would be detrimental to his or any other individual's health.
In appropriate circumstances, the information may be made available to
the subject by an appropriately qualified person, such as a doctor or a social worker,
whose relevant expertise would minimise the risk of harm to or misunderstanding by
the subject. Departments should also consider, where appropriate, the disclosure of
only part of a record, under the provisions of paragraph 1.13 of the Code.
Privacy of the individual
This provision is intended to protect the privacy of natural persons and
does not apply to the affairs of unincorporated associations, corporations or other
organisations but may prevent disclosure of whether any person is a member of any
particular group or other type of association of persons.
Information relating directly or indirectly to a living individual from
which it is reasonably practicable to identify that individual may only be disclosed to a
third party if permitted under the relevant provisions of the PDPO. Of particular
relevance is Data Protection Principle 3 (use of personal data) set out in Schedule 1 to
the PDPO : this principle provides that personal data may not, without the consent of
the subject of the data, be used for any purpose other than the purpose for which the
data was to be used at the time of collection, or a directly related purpose. It should
be noted that as far as personal data is concerned, whether it is in the public domain or
not is irrelevant to the consideration of release.
Part VIII of the PDPO provides for exemptions from this principle
where its application would be likely to prejudice certain specified public interests.
Legal advice should be sought if it is proposed to disclose personal data to a third
party by applying these exemptions.
The PDPO does not apply to information relating to a deceased person.
Nevertheless, consideration should be given to the extent to which disclosure would
infringe upon the privacy of close living relatives, and it may therefore be appropriate
to decline access to information concerning a deceased person under this provision of
Where the person seeking access to information is the subject of that
information or is in relation to the subject a “relevant person” (as defined in sections 2
and 17A of the PDPO, see paragraph 2.15.9 below), the Ordinance requires that the
information be disclosed to that individual within 40 days unless otherwise permitted
by the Ordinance. For the purposes of the Code “relevant person” corresponds with other appropriate person
(see para. 2.15.9 below). This requirement is, however,
subject to section 20. The exemption provisions in Part VIII may also be relevant.
Legal advice should be sought if it is proposed to deny access to personal data
requested by the subject or “relevant person” in relation to that data subject by virtue
of any of these exemptions. Where such disclosure cannot be made without
disclosing personal data of any other data subject, section 20(1)(b) of the PDPO
provides that the access request shall be refused. However, this provision only
operates if the source of information relating to another data subject is explicitly
identified and in such a case the request must still be complied with to the extent that
this can be done without disclosing the identity of the source by deleting his or her
name and any other identifying particulars, e.g. post title (section 20(2) refers)
The restriction on disclosing information to third parties does not apply
to information concerning an individual from which it is not reasonably practicable to
identify that individual. For example, statistical data that has been anonymised and
from which it is not reasonably practicable to ascertain or deduce the identity of a
In any case where it is proposed to disclose personal information to a
third party, care should be taken to ensure that Article 14 of Section 8 of the Hong
Kong Bill of Rights Ordinance (BORO) is complied with. This article provides as
“Protection of privacy, family, home, correspondence, honour and
(1) No one shall be subjected to arbitrary or unlawful interference
with his privacy, family, home or correspondence, nor to
unlawful attacks on his honour and reputation.
Everyone has the right to the protection of the law against such
interference or attacks.”
To disclose confidential personal information about a person without his or her
consent and without good reason would be an arbitrary interference with the person’s
privacy. In case of doubt, legal advice should be sought.
This provision is not limited to information provided on an explicit or
implicit basis of confidentiality. In order to determine whether information of
whatever classification that identifies an individual may be disclosed to a third party,
the guidance set out above should be followed.
Other appropriate person,
in relation to a living individual, means a
“relevant person” as defined in sections 2 and 17A of the Ordinance, that is –
where the individual is a minor, a person who has parental responsibility
for the minor;
(b) where the individual is incapable of managing his own affairs, a person
who has been appointed by a court to manage those affairs;
where the individual is mentally incapacitated within the meaning of
section 2 of the Mental Health Ordinance (Cap. 136) -
a person appointed under section 44A, 59O or 59Q of that
Ordinance to be the guardian of that individual; or
if the guardianship of that individual is vested in, or the functions
of the appointed guardian are to be performed by, the Director of
Social Welfare or any other person under section 44B(2A) or (2B)
or 59T(1) or (2) of that Ordinance, the Director of Social Welfare
or that other person;" or
(d) for the purpose of Part V of the PDPO, a person authorized in writing by
the individual to make, on behalf of the individual -
(i) a data access request; or
(ii) a data correction request.
In relation to a deceased person, other appropriate person
close living adult relative(s) which include the deceased’s spouse/partner, children,
parents or siblings, as appropriate, executor or administrator of the deceased person’s
There may be rare cases in which it is necessary to refuse disclosure of
information to a third party even though the other appropriate person
consent. Such circumstances could arise when the condition in DPP3(3) is not
satisfied, i.e. there is no reasonable ground for believing that the disclosure is clearly
in the interest of the data subject. In such cases legal advice should be sought as to
whether information may legitimately be withheld.