292 Hong Kong Cases [2008] 1 HKC 18. Section 2(1) of the Ordinance defines ‘personal data’ as any data: A — ‘(a) relating directly or indirectly to a living individual; (b) from which it is practicable for the identity of an individual to be directly or indirectly ascertained and B (c) in a form in which access to or processing of the data is practicable.’ 19. ‘Practicable’ is further defined under the same section as ‘reasonably practicable’. 20. ‘Data user’, in relation to personal data, is defined under s 2(1) of the Ordinance as ‘a person, who either alone or jointly in common with other persons, controls the collection, holding, processing or use of the data’. 21. ‘Control’ is not defined under the Ordinance, but ‘use’ is defined to include the disclosure or transfer of the data. 22. Data Protection Principle 3 (DPP3) in Sch 1 to the Ordinance stipulates that: ‘Personal data shall not, without the prescribed consent of the data subject, be used for any purpose other than — C D E (a) the purpose for which the data were to be used at the time of the collection of the data; or F (b) a purpose directly related to the purpose referred to in paragraph (a).’ 23. Under s 2(3) of the Ordinance, ‘prescribed consent’ means ‘express consent of the person given voluntarily which has not been withdrawn by notice in writing’. 24. An exemption from DPP3 is provided for where the use of the data is for the purpose of prevention or detection of crime, and the data user has reasonable grounds to believe that failure to so use the data would be likely to prejudice the purpose. In so far as it is material, ss 58(1) and (2) of the Ordinance provide as follows: G H ‘(1) Personal data held for the purposes of — (a) the prevention or detection of crime; (b) the apprehension, prosecution or detention of offenders … are exempt from the provisions of data protection principle 6 … (2) Personal data are exempt from the provisions of data protection principle 3 in any case in which — I