Respect Privacy and Purposes of Personal Data Collection

To offer personalised academic advice, an academic adviser is granted access to personal data of advisees. It is important for an academic adviser, under ethical, professional and legal obligations, to respect and protect the privacy and personal data of advisees. In particular, an academic adviser should pay attention to the requirements of the Personal Data (Privacy) Ordinance (Ordinance) and, if applicable, the European Union’s General Data Protection Regulation (GDPR).

The general requirement of the Ordinance is that personal data should only be used and disclosed with the prescribed consent of the data subject, or for the purpose (or a directly related purpose) for which the data has been collected.

In observance of the Ordinance, every student is informed via the Personal Information Collection Statement that their personal data will be used for the University to perform its administrative, educational, academic and research functions, as well as for the directly related purposes. In this respect, it is necessary to carefully consider whether any use or disclosure of personal data falls within these purposes or other directly related purposes. In case of doubt, prescribed consent of the data subject should be obtained.

The Ordinance has provided for certain exemptions on such grounds as prevention of crime, unlawful or seriously improper conduct, and protection of physical or mental health.

Principles to Observe in Academic Advising

As to practical issues, academic advisers should note and observe:

• Always seek students’ consent before disclosing their academic and/or personal information to others;
• After each advising meeting, keep concise notes, including any record of consent sought and given regarding information disclosure;
• Meeting notes, comments, file remarks and other records should provide an accurate and purpose-fit summary of the process, facts, advice and discussions;
• Bear in mind that personal data (which includes expressions of opinion as defined by the Ordinance) contained in meeting notes / comment is subject to statutory data access requests made pursuant to the Ordinance (i.e. students can request access to their personal data which are under the control of the University); and therefore, avoid including emotional commentaries or opinions down in the meeting notes; and
• If an advisee has personal or emotional issues that warrant a referral to a counsellor in CEDARS, advise the student that they should make an appointment with the CEDARS counsellor directly and promptly.

Important Information

Advisers are strongly recommended to review the following resources for more detailed information regarding privacy and personal data protection:

• University’s Code of Practice in respect of the Personal Data (Privacy) Ordinance
• Office of the Privacy Commissioner for Personal Data (PCPD)
• Personal Data (Privacy) Ordinance
• Definition of Personal Data
• Six Data Protection Principles
• General Data Protection Regulation (GDPR)

If you have further enquiries, please contact the University Data Protection Officer at privacy@hku.hk or visit the website of Data Protection Office: https://dpo.hku.hk/.