9. Are there any situations in which employers holding personal data may be exempt from the Ordinance or the data protection principles?

Sections 53 and 55 of the Ordinance state that personal data relating to the following purposes are exempt from the provisions of right of access (data protection principle 6):

• personal data relating to staff planning;
• personal data generated by certain evaluative processes, including a recruitment or promotion exercise, prior to a decision being taken and where an appeal can be made against such a decision;
• a personal reference for an appointment up to the time when the position is filled.

It should be noted that the use of any exemption is discretionary but not mandatory. In other words, an employer can still choose to comply with access requests to personal data irrespective of the above exemption.