Personal Data (Privacy) Ordinance Part 5—Division 1 5-4 Section 19 Cap. 486 (3) A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to the contrary, be treated as being a data access request under both paragraphs of that subsection, and the provisions of this Ordinance (including subsection (2)) shall be construed accordingly. (4) A data user who, in relation to personal data— (a) does not hold the data; but (b) controls the use of the data in such a way as to prohibit the data user who does hold the data from complying (whether in whole or in part) with a data access request which relates to the data, shall be deemed to hold the data, and the provisions of this Ordinance (including this section) shall be construed accordingly. (Amended 18 of 2012 s. 11) 19. (5) A person commits an offence if the person, in a data access request, supplies any information which is false or misleading in a material particular for the purposes of having the data user— (a) inform the person whether the data user holds any personal data which is the subject of the request; and (b) if applicable, supply a copy of the data. (Added 18 of 2012 s. 11) (6) A person who commits an offence under subsection (5) is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 11) Compliance with data access request (1) Subject to subsection (2) and sections 20 and 28(5), a data user must comply with a data access request within 40 days after receiving the request by— Verified Copy Last updated date 20.4.2018