|
Hong Kong Law Reform Commission |
3.1 The Personal Data (Privacy) Ordinance (Cap 486) was enacted to
implement the recommendations of the Law Reform Commission contained in its
report on Reform of the Law Relating to the Protection of Personal
Data.[132] The Ordinance has
general provisions which seek to regulate the collection and use of personal
data. It is important to bear in mind that the primary object of the Ordinance
has been to regulate the collection and use of personal data, not to provide
relief for invasion of privacy as such. A breach of a Data Protection Principle
does not necessarily entail an invasion of privacy. Likewise, there may be an
invasion of privacy without breaching a Data Protection
Principle.
3.2 Data Protection Principle 1 in Schedule 1 to the
Ordinance provides inter alia, that personal data shall be collected by means
that are “lawful and fair in the circumstances of the
case”.[133] This principle
does not cover all cases of invasion of privacy by intrusion. For example, A
may search B or his premises without consent in order to find out more about C.
Although B is a victim of A’s intrusion, B has no remedy against A under
the Ordinance because no recorded data have been collected to satisfy the
requirement of the Ordinance.
3.3 As regards the use and disclosure of
personal data, Data Protection Principle 3 provides that personal data may only
be used for “the purpose for which the data were to be used at the time of
the collection” or a directly related purpose unless the data subject
consents otherwise. This Principle only limits the purpose of a disclosure or
use of personal data; it does not aim at protecting the private life of
individuals from unwanted publicity as such. In particular, it offers limited
protection to people whose personal data are revealed in consequence of a crime,
accident or tragedy. Personal data collected by journalists from public
figures, victims and their friends and relatives are invariably for journalistic
purposes. Journalists may argue that including these data in a newspaper or
broadcast programme is consistent with the purpose for which the data were to be
used at the time of the collection of the data. Hence individuals whose right
of privacy has been infringed by the media publicising their data in connection
with a newsworthy event may not have a remedy under the Ordinance if it was a
journalist who had collected the data and the collection was lawful and fair in
the circumstances.[134] In other
words, as long as the data are collected lawfully and fairly and the publication
is for the purpose for which the data were to be used at the time of the
collection, the Ordinance would not restrain the publication even though it
amounts to an invasion of privacy.
3.4 A person whose personal data have been collected or used in
contravention of a data protection principle may request the Privacy
Commissioner to investigate the matter. Where the Commissioner is satisfied
that the data user is contravening a data protection principle, or has
contravened such a principle “in circumstances that make it likely that
the contravention will continue or be repeated”, he may serve on the data
user an enforcement notice directing him “to take such steps as are
specified in the notice to remedy the contravention or, as the case may be, the
matters occasioning it” within the specified
period.[135] The Ordinance fails
to provide any remedy where the complaint concerns an isolated contravention or
there is merely a threat or an attempt to act in contravention of a data
protection principle. It compares unfavourably to section 6 of the Hong Kong
Bill of Rights Ordinance (Cap 383) which provides, inter alia, that the
court may grant such remedy or relief in respect of a “threatened
violation” as it has power to grant in the proceedings.
3.5 Although the Ordinance does not make a breach of a data
protection principle a tort, an individual who suffers damage by reason of a
breach of a data protection principle relating to that individual’s
personal data is entitled to “compensation” from the data
user.[136] It is not clear how
“compensation” would be assessed except that “damage”
includes injury to feelings. Thus any person whose personal data are collected
or used in contravention of a data protection principle may seek compensation
pursuant to the provisions of the
Ordinance.[137]
3.6 Another
limitation is that the Ordinance applies only to recorded
data.[138] Its provisions will
not operate to control visual and aural surveillance unless and until the data
user has put the data acquired by such means “in a form in which access to
or processing of the data is
practicable”.[139] As a
result, a data subject may not have a claim against an eavesdropper or Peeping
Tom who intrudes upon the privacy of another without using any recording device
and without putting the data obtained by the intrusion in a recorded form.
Similarly, an individual who has carried out a body search or who has searched
the premises of another without consent is not liable under the Ordinance if the
search process is not recorded.
3.7 Personal data held by an individual
only for recreational purposes or which are concerned only with the management
of his personal, family or household affairs are exempt from the Data Protection
Principles.[140] However, these
data may contain sensitive or embarrassing personal information about another.
Under the Ordinance, as long as these data are intended to be and are in fact
used by the data user for recreational purposes, their collection needs not
comply with DPP 1 and the data user may use unfair means to collect
them.
3.8 Another difficulty with enforcing the data protection
principles under the Personal Data (Privacy) Ordinance relates to their content.
As they are intended to be statements of principle, the data protection
principles are expressed in general terms. The Privacy Commissioner has stated
that Data Protection Principles 1 and 3 are open to wide interpretation.
Paragraph 2 of Data Protection Principle 1, for instance, merely provides that
personal data shall be collected by means which are “lawful” and
“fair in the circumstances of the case”. It fails to define in
precise terms the circumstances under which liability would be imposed on
wrongdoers. The Privacy Commissioner and the Court have a wide discretion in
determining whether a collection or use constitutes a
contravention.
3.9 The way the Ordinance is drafted also puts the
complainant or plaintiff, as the case may be, in a disadvantageous position.
The Ordinance places the burden on him to show that the data in question falls
within the definition of “personal data” in the Ordinance. This
requires him to satisfy the Privacy Commissioner or the Court that none of the
specified exemptions applies to the data. The data user who is alleged to have
contravened a data protection principle has no obligation to show that the
collection or disclosure can be justified on one of the grounds prescribed in
the Ordinance.
3.10 In the light of the limitations of the Personal Data
(Privacy) Ordinance, it is clear that the Ordinance cannot always provide
satisfactory relief to victims of invasion of
privacy.[141]
[132] Topic 27,
1994.
[133] The Privacy
Commissioner is of the opinion that covert collection of personal information is
considered to be generally unfair unless there is an overriding public interest.
Furthermore, if the individual, whether he is a celebrity or not, makes it clear
that he does not wish to be photographed, the collection would also be regarded
as generally unfair. South China Morning Post, 27 September
1997.
[134] Although the media
are not exempt from Data Protection Principle 1, section 61 of the Ordinance
provides for an exemption for the disclosure of personal data to the
media. As far as Data Protection Principle 3 is concerned, the exemption
covers only the disclosure of personal data by a person to the newspaper
proprietor or broadcaster. It does not apply to the subsequent publication or
broadcasting even though doing so is in the public interest, unless publicising
the data is consistent with the purpose for which the data were to be used at
the time of collection, or a publisher or broadcaster can rely on one of the
exemptions under Part VIII of the Ordinance (e.g. crime prevention or protection
of health).
[135] Cap 486,
section 50. For an overview of the Ordinance, see M Berthold & R Wacks,
Data Privacy Law in Hong Kong (Hong Kong: FT Law & Tax Asia Pacific,
1997).
[136] Cap 486, section
66.
[137] See also paras 12.11
- 12.15.
[138] See the
definition of “personal data” in section 2(1) of the Ordinance.
[139] Above. See
HKLRC, Report on Reform of the Law Relating to the Protection of Personal
Data (1994), paras 8.10 -
8.11.
[140] Section
52.
[141] See also Chapter 5
of the Consultation Paper on The Regulation of Media Intrusion (1999)
published by the HKLRC Sub-committee on Privacy.