A PICS will determine how personal data is to be used/stored/retained subsequent to collection. As such, the statement should be well planned.
Factors to be considered for a PICS:
| • |
|
A PICS should be included on hardcopy forms, web pages, or any other medium that are used for data collection (e.g. student admission, job application, appointment letter, student registration form, seminar sign-up form, etc.). |
| • |
|
A typical PICS should contain the following information :
| – |
|
Statement of purpose |
| – |
|
Indicate which data are obligatory/voluntary and the consequence(s) of not providing the obligatory data |
| – |
|
Statement about disclosure |
| – |
|
About security |
| – |
|
About duration of retention |
| – |
|
About the right to access and correction |
| – |
|
Provision(s) for enquiries |
|
| • |
|
Each such statement should be reviewed and tailored to suit the context concerned. |
| • |
|
The statement should cover those uses of the data for which the data needs to be collected. It may be broad but should not be overly vague as to render it meaningless.
As personal data can only be used for the original purpose of collection (or a purpose directly related to the original purpose), it would be prudent to set out in the PICS at the outset the other purposes you envisage for which personal data may be used to avoid argument and so that you can use the personal data for those other purposes without the need to seek the individual’s consent each time. |
| • |
|
The availability and content of PICS statements and the provision for consent should be reviewed on a periodic basis (e.g. annually). |
| • |
|
The use of the data for research purpose
| – |
|
While the initial collection of data may primarily be for administrative/operational use, where envisaged, the potential use of data for research should be incorporated into the PICS. Statements such as the following can be considered:
…It is expected that personal data will also be used for research or statistical/analytical purposes to further the University’s mission (i.e. to advance learning and knowledge through teaching and research, particularly in science, technology, engineering, management and business studies, and at the postgraduate level; and to assist in the economic and social development of Hong Kong… .
|
| – |
|
Where research is not explicitly mentioned in the original PICS, it will be necessary to establish that research is an activity that is directly related to a stated purpose in the original PICS, in order for the data to be used. |
| – |
|
If neither of the above applies, the personal data can still be used for research (under Section 62 of the PDPO) if all of the following criteria are met:
| √ |
|
the personal data is to be used for preparing statistics or carrying out research; |
| √ |
|
the personal data will not be used for purpose(s) other than the original purpose(s) or a directly related purpose or in preparing statistics or carrying out research; |
| √ |
|
the resulting statistics or results of the research are not made available in a form which identifies the data subjects or any of them. |
Accordingly, as long as the requirements in Section 62 are satisfied (in particular, that the personal data will be fully depersonalized in the results), personal data originally collected for other purposes can be subsequently used in research (as a new purpose) without the need to seek prescribed consent from the individual.
However, if the personal data will not be depersonalized in the results or despite efforts to depersonalize, it is still be possible for the individual to be identified from the results (e.g. due to a small data pool) then section 62 cannot be relied upon and prescribed consent is needed before you can use the personal data in research as a new purpose.
|
|
| • |
|
Further guidelines on preparation of PICS
The Office of the Privacy Commissioner for Personal Data has issued a Guidance Note on preparing PICS. Members of staff who are required to prepare PICS are advised to further consult this Guidance Note. |
