Page:Improper Collection, Retention, Use and Storage of Personal Data of Residents and Visitors by Property Management Companies.pdf/3

  notices for discharge of the above duty is related to building management. However, property management companies should carefully consider and assess the necessity of publishing information containing an individual's personal data and the amount of data involved, especially when sensitive personal data is involved.

In this case, Cheong Sun aimed to inform property owners by the notice that those 48 owners' overdue payments had put financial strains on Scenic Garden, and reminded those owners of their duty to pay the arrears as soon as possible. The Commissioner considered that Cheong Sun should have been able to collect the payment of arrears by putting separate notices into the mailboxes of the 48 owners, without any need to attach the List. Moreover, even though Cheong Sun intended to inform other property owners that 48 owners had not paid on time, it was unnecessary to post in public the personal data of those 48 owners. Under the above circumstances, the Commissioner considered that Cheong Sun had contravened the requirements of DPP3(1) as regards the use of personal data in the present case.

Enforcement Action

The Commissioner has served an Enforcement Notice on Cheong Sun directing it not to unnecessarily disclose property owners' personal data to third parties when it tries to recover arrears in the future, unless express and voluntary consent of the data subject is obtained, or the disclosure is otherwise in compliance with the law. Moreover, the Commissioner also directs Cheong Sun to formulate clear written policies and guidelines for staff compliance; circulate policies and guidelines among staff on a regular basis; and provide staff training to raise their awareness of personal data protection to prevent recurrence of similar contravention of the Ordinance.

Investigation Case (2): Creative Property Services Consultants Limited Failed to Set Retention Period for the Personal Data Collected During a Mask Distribution Activity and Failed to Properly Place Residents' Personal Data

Case Background

Creative Property Services Consultants Limited (Creative Property Services), which was responsible for the management of Ching Ho Estate in Sheung Shui, assisted the government in distributing face masks to 