Schedule 1 DPP1 Data Collection Principle requires personal data shall not be collected unless for a lawful purpose directly related to a function or activity of the data user, the data is adequate not excessive relevant to that purpose, and the means of collection are lawful and fair. At or before collection, the data user must explicitly take all practicable steps to ensure data subject is informed of: purpose of collection, classes of persons to whom data may be transferred, whether collection is obligatory or voluntary, consequences of non-supply if obligatory, name + title + address of individual to handle data access requests. This is operationalised through a Personal Information Collection Statement (PICS) typically presented at or before collection (forms, websites, applications, customer onboarding, employee onboarding, registration, surveys). PICS components: identification of data user + purpose + classes of transferees + obligatory or voluntary + consequences + DAR contact + retention period (best practice) + cross-border destination jurisdictions (best practice). Online + mobile + IoT + sensor PICS must address fairness in covert collection contexts. AI training data scraping requires DPP1 evaluation under PCPD 2024 Model Generative AI Framework. HK PDPO DPP1 + PICS + lawful collection + fair means + purpose specification applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.