- households in June 2021. Residents who had registered at the main lobby and collected a box of face masks must fill in their names, unit numbers and collection dates on the "Mask Receipt Record" (Receipt Record), and acknowledged receipt of the masks with signature.
- According to the complainant, Creative Property Services had failed to adopt any measures to cover the entries on the Receipt Record, which was a common form. He could see the personal data of other recipients when he signed on the Receipt Record. Moreover, the complainant stated that the staff of Creative Property Services had placed the Receipt Record in a paper box beside a work desk, without covering relevant records. Hence, the complainant believed that Creative Property Services had not properly protected the personal data of the residents who had collected their masks as stated in the Receipt Record.
- Besides, the complainant indicated that Creative Property Services had not informed the residents of the retention period of the personal data in the Receipt Record.
Investigation Findings and Contraventions
Creative Property Services Contravened DPP2(2)
- DPP2(2) of Schedule 1 to the Ordinance stipulates that personal data shall not be kept longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is or is to be used.
- Before a property management company decides to collect residents' personal data, it should determine the purpose of collection and specify the retention period of the personal data, and ensure that the personal data shall not be kept longer than is necessary for the fulfilment of the purpose (including any directly related purpose) for which the data is or is to be used, so as to comply with the requirements of DPP2(2).
- In this case, Creative Property Services failed to specify the retention period of the personal data contained in the Receipt Record at the material time. It was not until the intervention of the PCPD then Creative Property Services decided when to destroy the personal data. Hence, the Commissioner found that Creative Property Services had contravened the requirements of DPP2(2) as regards the retention of personal data.
4
