Be cautious when posting data on websites

Website operators are often tempted to post lots of information on their website because it does not cost them much and because they believe that an informative website may attract more visitors. However, Principle 3 of the Ordinance states that any information collected by a data user can only be used for the purposes defined at the time of collection and any other uses of collected data must have the ‘consent’ of the data subject who gave the information.

Imagine that a sports association is hosting a squash competition and asks all the competitors to register for the competition online. After the sports association has received all the competitors’ details, it wants to post the draw for the competition (i.e. tell all the competitors how many games will be played in different age groups or ability groups).

The data collected from each competitor is as follows:

1. Name
2. Age
3. Sex
4. Player level (including information about championships that players have won).
5. Name of indoor sports club or district players are representing.

To comply with Ordinance, the squash association needs to tell all competitors why it is collecting this personal data and it must not use this information for any other reasons, unless it gets the consent of all competitors. So on its website, the sports association tells competitors that its purpose collecting the information is to tell everyone information about the competition's categories. If the association simply uses the information to publicize the different categories of the competition it is complying with the Ordinance.

However, if the competition attracts some famous players and the sports association decides that it can promote the event by publishing biographies of these players, it may be in breach of the Ordinance if it does not get consent from these players to use their personal information to promote the event.