[2008] 1 HKC A B C Shi Tao v Privacy Commissioner for Personal Data (Administrative Appeals Board) 293 (a) the use of the data is for any of the purposes referred to in subsection (1) (and whether or not the data are held for any of those purposes); and (b) the application of those provisions in relation to such use would be likely to prejudice any of the matters referred to in that subsection, and in any proceedings against any person for a contravention of any of those provisions it shall be a defence to show that he had reasonable grounds for believing that failure to so use the data would have been likely to prejudice any of the matters.’ 25. Section 38 gives the Commissioner the power to carry out investigation into complaints: ‘Where the Commissioner — (a) receives a complaint; or D (b) has reasonable grounds to believe that an act or practice — (i) has been done or engaged in, or is being done or engaged in, as the case may be, by a data user; E (ii) relates to personal data; and (iii) may be a contravention of a requirement under this Ordinance, then — F G H (i) where paragraph (a) is applicable, the Commissioner shall, subject to section 39, carry out an investigation in relation to the relevant data user to ascertain whether the act or practice specified in the complaint is a contravention of a requirement under this Ordinance; (ii) where paragraph (b) is applicable, the Commissioner may carry out an investigation in relation to the relevant data user to ascertain whether the act or practice referred to in that paragraph is a contravention of a requirement under this Ordinance.’ 26. Section 39(1)(d) provides that the Commissioner may refuse to carry out or continue an investigation initiated by a complaint if none of the following conditions is fulfilled: ‘(i) either — I (A) the complainant (or, if the complainant is a relevant person, the individual in respect of whom the complainant is such a person) was resident in Hong Kong; or (B) the relevant data user was able to control, in or from Hong Kong. the collection, holding, processing or use of the personal data concerned,