Hong Kong Centre for Cerebro-Cardiovascular Health Engineering Limited (the “Company”) undertakes to observe the spirit and to comply with the principles and requirements of the Personal Data (Privacy) Ordinance (Chapter 486 of the Laws of Hong Kong) and the related personal data law in its data management policies and practices.

This code of practice aims to provide staff members of the Company with practical guidance on the collection, processing and use of personal data. Administrative arrangements have also been put in place to deal with data access and correction requests.

Information in this code of practice is subject to the complete and definitive statement of the Ordinance itself and by no means exhaustive. Enquiries concerning protection of personal data should be directed to the Data Protection Officer of the Company at email: it@hkcoche.org.

Section 1 : Introduction

1.1 Introduction

The Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) (the “Ordinance”) was enacted on 3rd August 1995. Subsequently, the Ordinance became effective from the 20th December 1996.

This piece of legislation gives new rights to individuals about whom information is kept and used by other individuals and organizations. They may find out what is being recorded about themselves, obtain a copy of their own personal data held, and request changes if appropriate. The Ordinance places obligations on users of such information to collect, store, and use personal data lawfully and fairly. Furthermore, the Ordinance applies to all personal data held by users, irrespective of the media of storage or whether the processing is done via automation or not. That is, the provisions of the Ordinance apply to computerized data as well as paper records about individuals.

The Ordinance is divided into ten parts and has seventy three sections altogether. The officer in charge of data protection matters under the Ordinance is the Privacy Commissioner for Personal Data. He heads an independent statutory office known as the Office of the Privacy Commissioner for Personal Data. In accordance with similar legislation set up in other countries, the Ordinance is underpinned by six data protection principles. The principles are concerned with good data management practices which users of personal data should follow. The six data protection principles in their entirety are attached as Appendix I; they are also briefly described in section 1.3 below.

1.2 Data Protection Terminology

Data Protection has its own terminology. Some of the commonly used ones are given in this section as defined in the Ordinance, with brief explanations.

1. Data - any representation of information (including an expression of opinion) in any document, and includes a personal identifier.

2. Personal Data - any data---

a. relating directly or indirectly to a living individual;

b. from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and

c. in a form in which access to or processing of the data is practicable.

For the purpose of this code of practice, the terms "data" and "personal data" are used interchangeably. "Personal data" are facts (or information) relating to a living person, and this person can be identified from such facts held. "Personal data" includes facts and expressions of opinion, but not the intention, i.e. the purpose of holding or use, of the data users towards the data subjects.

3. Data User - a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of personal data.

A "data user" is sometimes known as the "data controller". He/She is the user of the personal data, the legal person responsible for the collection and processing of the data.

4. Data Subject - the individual who is the subject of the personal data.

A "data subject" is sometimes also referred to as the "data provider". He/She is an individual whose personal data are held and processed by or on behalf of a data user.

5. Data Access Request - a request under section 18 of the Ordinance.

A "data access request" is also called a "subject access request". The Ordinance gives specific right to a data subject to request a data user to:

a. be informed whether the data user is holding personal data of the data subject;

b. supply a copy of the personal data of the data subject, if the data user holds such data.

6. Document - includes, in addition to a document in writing---

a. a disc, tape or other device in which data other than visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the disc, tape or other device; and

b. a film, tape or other device in which visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the film, tape or other device.

A "document" under the Ordinance has a much wider definition which includes a variety of media on which personal data can be recorded.

1.3 The Six Data Protection Principles of the Ordinance

The six data protection principles underpinning the Ordinance are printed in full in its Schedule 1. They are also attached as Appendix I to this document for reference. These principles cover the conducts and responsibilities of the data users about the collection, processing, use and duration of storage of personal data. They specify that data users have to install adequate security measures to safeguard the integrity and accuracy of the data, and to protect them from unauthorised alteration or destruction. Furthermore, the principles also state the rights of an individual data subject to access and verify the data held about him. The following section describes the principles briefly with some indications on compliance requirements. Please refer to Appendix I for the full text of the six data protection principles under the Ordinance.

Principle 1 - purpose and manner of collection of personal data

Personal data should not be collected at all unless the purpose(s) for the collection is(are) lawful and directly related to the data user's functions or activity. There should be a limit to the amount of personal data held for particular purpose(s), that is, the data collected and held should be of sufficient quantity, not excessive, and the content of the data should be relevant to the purpose(s). Furthermore, data subjects should be informed of the purpose(s) at the time their personal data are being collected from them.

Principle 2 - accuracy and duration of retention of personal data

Data users must pay attention to maintain the content quality of the data in that they must be kept accurate, correct and up-to-date. This principle is also concerned with issues regarding disclosure and the duration of holding personal data. The Ordinance contains very strict and specific instructions and restrictions on transfer outside Hong Kong and matching of personal data. Regarding the duration of holding the data, data should not be kept for longer than is necessary for the fulfilment of the purpose(s). Thus data users are obligated to review their collection, processing and use of personal data periodically such that data kept and used are accurate and up-to-date, and data no longer required are disposed of accordingly.

Principle 3 - use of personal data

Personal data collected should not be used for purpose(s) other than those specified, unless specific consent given voluntarily has been obtained from the data subjects.

Principle 4 - security of personal data

This principle requires the data user to install proper security measures and procedures to safeguard the access, processing and transmission of the data. In practice, security measures and procedures are required for equipment as well as personnel.

Principle 5 - information to be generally available

This principle addresses the issue of openness in personal data collection and usage. A data user must ensure that anyone can ascertain its policies and practices in relation to personal data, as well as the kinds of personal data it holds and the purposes it uses the data for.

Principle 6 - access to personal data

This principle specifies the rights of a data subject to access his own data being held by a data user, as well as requesting corrections to his data if appropriate. (These requirements are elaborated upon in some detail in the main body of the Ordinance). Therefore standard procedures involved in a subject access/data correction request have to be established and practised by data users.