The Regulation of Media Intrusion - [1999] HKLRCCP 3 (August 1999) - The Law Reform Commission of Hong Kong Consultation Paper - The Regulation of Media Intrusion - Chapter 5 - Regulation under the Personal Data (Privacy) Ordinance

5.2 News reports, photographs and video footage of individuals from which it is practicable to identify the individuals concerned constitute personal data under the Personal Data (Privacy) Ordinance (“PDPO”). Media intrusion may therefore entail a breach of one of the Data Protection Principles stated in the schedule to the Ordinance. Any individual whose data have been collected or published by a news organisation in breach of a Data Protection Principle (“DPP”) may lodge a complaint with the Office of the Privacy Commissioner for Personal Data. If the Commissioner upheld the complaint, he may issue an enforcement notice directing the news organisation “to take such steps as are specified in the notice to remedy the contravention or, as the case may be, the matters occasioning it.”[270] It seems that the Commissioner may, in serious or significant cases, require the offending news organisation to publish an apology or correction in its publication if this is an appropriate remedy. Any data user who contravenes an enforcement notice commits an offence and is liable on conviction to a fine and to imprisonment for 2 years. Where the data subject suffers damage by reason of the contravention, he may also claim compensation by bringing legal proceedings pursuant to section 66 of the PDPO.

5.3 DPP 1(1) provides that personal data shall not be collected unless: (a) the data are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data; (b) the collection is necessary for or directly related to that purpose; and (c) the data are adequate but not excessive in relation to that purpose. News organisations and journalists are not exempt from DPP 1. However, whether a collection is “necessary for” or “directly related to” journalistic purposes and whether data collected by a journalist are “excessive” in relation to these purposes are open to interpretation.

5.4 DPP 1(2) requires that personal data should be collected by means which are both lawful and fair in the circumstances. This means that the media is prohibited from collecting personal data by means which are unfair even though doing so is not unlawful. Where the data subject has been deceived or misled as to the purpose for which the data are to be held or used, the collection is likely to be treated as unfair if no public interest is involved.

5.5 The Privacy Commissioner has advised that collection by means unknown to the individuals (for example, photo-taking in public places using long-range camera lens or hidden cameras) is generally not considered to be a fair means of collection. Other examples given by the Commissioner include the taking of photographs of individuals in private premises from outside those premises without their consent, and the taking of photographs of individuals in public where they have made it clear that they do not wish to be photographed. However, these means might be considered fair if there is an over-riding public interest in the collection of personal data.[271]

5.6 In addition to DPP 1, DPP 3 provides that personal data shall not, without the “prescribed consent” of the data subject, be used for any purpose other than “the purpose for which the data were to be used at the time of the collection of the data”. News organisations are therefore under an obligation to ensure that personal data collected by journalists are used only for journalistic purposes unless the data subject agrees otherwise.

5.7 The Data Protection Principles in the Ordinance are broad statements of principle for the general guidance of data subjects and data users. They do not provide sufficient guidance to the news media in relation to the collection of information with a view to its publication or broadcasting. It should be noted that the overwhelming majority of the examples cited in this Paper occurred after the PDPO came into force. This illustrates that the general provisions contained in the Data Protection Principles have not as yet provided effective protection to individuals who have suffered at the hands of the news media.

Code of practice under the Personal Data (Privacy) Ordinance

5.8 Under the PDPO, the Privacy Commissioner may issue codes of practice for the purpose of providing practical guidance for the observance of the Data Protection Principles. He therefore has power to issue a Code of Practice on the collection and use of personal data for journalistic purposes. A Code of Practice which applies to all journalists and news organisations would not only give substance to the Data Protection Principles as applied to the news media, but would also give practical guidance and protection to the news media and the public. It would be particularly helpful in explaining what types of data collection methods would be deemed unfair under DPP 1. The Code may also clarify under what circumstances personal data would be regarded as excessive in relation to journalistic purposes. Where a journalist or news organisation is alleged to have contravened a DPP, the Code may be adduced in evidence in proceedings under the Ordinance.[272]

5.9 Strengthening protection under the PDPO by means of a Code of Practice is a viable approach to the problem of media intrusion. Under this option, the Code would be approved by a body independent of both the industry and the Government. Enforcement of the Code by the Privacy Commissioner would also have the backing of the statutory powers and sanctions under the Ordinance. The Office of the Privacy Commissioner provides a well-established machinery to adjudicate upon complaints against the media. Since the Commissioner is now the focus of attention on privacy matters, issuing such a Code would also increase the awareness of the public of their rights against the media under the PDPO. Another advantage is that the Code would apply to private individuals as well as newspaper publishers and licensed broadcasters. Any person who publishes personal data on the Internet or collects personal data with a view to their publication in the news media (including the Internet) would be subject to the Code, whether or not that person is a news organisation or journalist.

5.10 The Privacy Commissioner was reported as saying that he received few complaints from celebrities or public figures regarding media intrusion.[273] He said there had not been a demand from public figures to have guidelines on media intrusion. We think that the number of complaints of media intrusion from public figures is not an accurate reflection of the level of media intrusion experienced by the general public. Public figures are not the only persons who may be aggrieved by the intrusive conduct of the news media. Ordinary citizens who are neither wealthy nor powerful and who do not have any interest group to look after their interests are particularly liable to have their privacy intruded upon by the news media. The examples in this paper illustrate that ordinary citizens represent the bulk of the victims and that media intrusion is by no means uncommon in Hong Kong. The fact that not many complaints have been initiated may be explained by expectations that media intrusions are not covered by law and by the fact that some invasions of privacy are not perceived by victims.

5.11 We consider that the Privacy Commissioner should invite the industry to produce a code for his approval. In the event that the industry fails to co-operate with the Commissioner or cannot reach agreement on a draft code, the Commissioner should step in and take up the responsibility to prepare the code.[274]

Recommendation 1

We recommend that the Privacy Commissioner for Personal Data issues a code of practice on the collection and use of personal data for journalistic purposes for the practical guidance of publishers, broadcasters, journalists, Internet users, and other members of the public.

Need for further measures to regulate media intrusion

5.12 On the assumption that the Privacy Commissioner agrees to issue a Code of Practice as recommended above, a question arises as to whether this recommendation without more would afford adequate and effective protection to victims of media intrusion. Our preliminary view is that even if the Privacy Commissioner agrees to issue a Code of Practice for the news media, it is likely to be of limited effect.

Data Protection Principle 1

5.13 By virtue of DPP1(1), a news organisation must collect personal data for a lawful purpose directly related to a function or activity of the organisation. The collection must also be “necessary for or directly related to” such a purpose. Furthermore, the data must not be excessive in relation to the same. Section 61(3) of the PDPO defines “news activity” as meaning any journalistic activity and including the gathering of news for the purpose of dissemination to the public, and the dissemination of news to the public. As it is always open to a news organisation to argue that personal data collected by its journalists are worthy of discussion or of reporting by the media and that the data are collected for the purpose of dissemination to the public, data collected by journalists are normally for a lawful purpose directly related to a news activity. It is unlikely that the Privacy Commissioner would substitute a news organisation’s judgment as to what information is newsworthy with his. By the same token, it is open to a news organisation to argue that the collection of personal data in connection with a newsworthy event is necessary for or directly related to a journalistic purpose.

5.14 Further, it is difficult for a data subject to argue that data collected by a news organisation are excessive in relation to a journalistic purpose. Journalists are only interested in collecting data that are “newsworthy” or would assist them in collecting data worthy of reporting. These data are directly related to journalistic purposes and are not excessive in relation to the same. Moreover, since the Privacy Commissioner has no right to inspect the personal data systems used by media organisations and can only look at the personal data reported in the news media to assess compliance with DPP 1(1), he could not truly assess whether any data collected by a media organisation are excessive for the purpose of DPP 1(1). One may safely conclude that DPP 1(1) is of limited consequence to the news media.

5.15 DPP 1(2) requires that the collection be fair but it is doubtful to what extent a Code of Practice elaborating on fair collection could help. The requirement that personal data be collected by means which are fair in the circumstances is a loose one. The news media would be quick to point out that publication and news-gathering require separate treatment. They would argue that although they should refrain from publishing personal information, including pictures, if this constitutes an unwarranted invasion of privacy, it is generally fair for journalists to approach or take pictures of a person involved in a newsworthy event even though he is a victim of a tragedy or an unlawful act and is not physically or mentally fit. It is difficult for the Privacy Commissioner to refute such an argument if the data subject is a legitimate subject of public interest and is in a place accessible or visible to the public. As far as news-gathering activities are concerned, consent of the data subject is not the only determining factor where the subject concerned becomes part of an event of public concern through his own conduct or by force of circumstances.

5.16 More importantly, most of the cases of unwanted publicity in the press relate to personal data collected by means which are both lawful and fair in the circumstances. Thus, even if the Privacy Commissioner could produce detailed guidelines on fair collection practices for the news media, the guidelines would not have a significant impact on the industry. Regulating unfair collection practices by the news media is not sufficient to tackle the problem of unwanted publicity given by the press.

5.17 Further, since the PDPO defines “personal data” as data relating to a living individual, the Code would not cover the public disclosure of private facts about a deceased. The surviving relatives and friends could not complain under the Ordinance if personal data about the deceased have been collected and used in breach of the Data Protection Principles.

Data Protection Principle 3

5.18 DPP 3 provides that personal data shall not, without the “prescribed consent” of the data subject, be used for any purpose other than “the purpose for which the data were to be used at the time of the collection of the data”. This principle offers limited protection to people whose personal data are revealed in consequence of a crime, accident or tragedy. The Privacy Commissioner has advised that by not objecting to the reporters taking photographs, the individuals concerned are deemed to have given implied consent to publication of their photographs taken by the reporters.[275] In fact, whether or not the individuals have consented to publication is neither here nor there. Personal data in relation to victims and public figures are collected by journalists for journalistic purposes. Journalists can always argue that including these data in a newspaper is consistent with the purpose for which the data were to be used at the time of the collection and, therefore, consistent with DPP 3.

5.19 The gravamen of unwanted publicity is non-consensual publication of private facts in the media. However, consent of the data subject is not the key issue in DPP 3. Under DPP 3, consent is an issue if and only if the data are used for any purpose other than “the purpose for which the data were to be used at the time of the collection”. A data user is not required to obtain the consent of the data subject if the former uses the data for the original intended purpose. Hence, it is unnecessary for a newspaper which has collected personal data for journalistic purposes to obtain the consent of the data subject before publishing the data in the newspaper. It is not a contravention of DPP 3 for a newspaper to publish, against the wishes of the data subject, personal data collected by it for journalistic purposes even though the publication amounts to an unwarranted intrusion.

5.20 It is true that by virtue of DPP 1, personal data collected by a journalist must not be excessive in relation to journalistic purposes. However, this requirement does not preclude journalists from obtaining personal data about data subjects involved in newsworthy events. Journalists may require these data for good purposes, for example, to check accuracy or credibility or to follow up a news story. But giving publicity to these data is a different matter. Although it is normally legitimate to obtain the name, age and address of the data subject in a newsworthy event, publishing them in a newspaper might constitute an unwarranted invasion of privacy if it cannot be justified in the public interest. Neither DPP 1 nor DPP 3 may assist the subject who does not wish to see his personal particulars disclosed in the press.

5.21 In practical terms, the Code of Practice recommended to be issued by the Privacy Commissioner would not restrain the news media from publishing the following matters if such matters have been obtained by journalists without contravening DPP 1:

individuals who are formerly public figures but have retired into a life of seclusion;

5.22 The object of the Ordinance has been to protect the privacy of individuals in relation to personal data, not to protect individuals from invasion of privacy as such. The Data Protection Principles do not cover all forms of media intrusion. There may well be an invasion of privacy without breaching DPP 3. DPP 3 only limits the purpose of a use or disclosure of personal data; it does not aim at protecting the private life of individuals from unwanted publicity as such. The principle merely states that data must not be used for a purpose other than the purpose for which they were to be used at the time of the collection; it does not provide that data must not be used in such a way as would constitute an unlawful or arbitrary interference with the privacy of the data subject.

5.23 Data collected by journalists are for journalistic purposes. Publishing the data in a newspaper is consistent with journalistic purposes even though this might infringe the data subject’s privacy without justification. It is unlikely that a news organisation which has given publicity to personal data in its newspaper would be held liable for a breach of DPP 3 even though the data subject objects to such publicity. As long as the data are collected lawfully and fairly and for a journalistic purpose, DPP 3 would not forbid a news organisation giving publicity to the data. Individuals whose right of privacy has been infringed by the media publishing their data in connection with a newsworthy event may not have a remedy under the PDPO if it was a journalist who had collected the data and the collection was lawful and fair in the circumstances.

5.24 DPP 3 is therefore not effective in protecting individuals from unwanted publicity. Whereas the requirement that personal data be collected by fair and lawful means under DPP 1 would provide a mandate for the Privacy Commissioner to issue guidelines for the purposes of regulating the unfair collection of personal data by the media, DPP 3 is not helpful when it comes to the news media infringing an individual’s privacy by giving publicity to personal data lawfully obtained by a journalist.[276] We therefore conclude that any Code of Practice issued by the Privacy Commissioner would be neither adequate nor effective in protecting individuals from unwanted publicity given by the press.

Exemptions for the news media under section 61(1)

5.25 In order to ensure that the media would not be inhibited from performing the role of a watchdog, the PDPO granted various exemptions to the news media. By virtue of section 61(1), publishers and broadcasters are exempt from the provisions of DPP 6 and sections 18(1)(b) and 38(i) unless and until the data are published or broadcast (wherever and by whatever means). The same section also exempts publishers and broadcasters from the provisions of sections 36 and 38(b). The effects of section 61(1) are as follows:

5.26 Because of the constraints laid down in section 61(1), the Privacy Commissioner cannot be proactive in ensuring that the news media would comply with the Data Protection Principles. The Commissioner cannot initiate an investigation even though he has reason to believe that a news organisation has contravened DPP 1 or 3. He can only react passively to complaints made by members of the public. Yet even if he has received a complaint, he cannot conduct an investigation in relation to the news organisation concerned unless and until the data have been published or broadcast. A data subject whose data have been collected by a journalist in breach of DPP 1 does not have a right to request access to his data held by the journalist or the news organisation concerned unless and until the data are published or broadcast.

5.27 It would be entirely a matter for the Privacy Commissioner to decide whether to issue a Code for the media. Even if he is in favour of issuing such a code, it is doubtful whether the industry is willing to co-operate with him in producing it. By reason of section 61(1), the Privacy Commissioner may not inspect the personal data system used by the news organisations for the purposes of drafting the Media Code. He would have to rely on the co-operation and advice of the industry in understanding the functions and needs of the news media.

Privacy torts proposed in the Civil Liability Paper

5.28 We have recommended in our consultation papers on Stalking and Civil Liability for Invasion of Privacy that the following acts or conduct should be tortious:

5.29 If all the above proposals were adopted, it would go some way towards resolving the problem of media intrusion. But bringing a legal action for invasion of privacy would not only be costly and time-consuming but would also further publicise the very information which the victim once sought to keep private. Protection against media intrusion should not be restricted to legal measures. More importantly, many cases of media intrusion are not covered by our proposals, as when:

5.30 Our proposals on imposing civil liability for invasion of privacy based on public disclosure of private facts are of no avail to the majority of victims who are unfortunate enough to become the subject of a newsworthy event. The law of privacy as developed under our proposals would accord substantial latitude for news-gathering in public places. Journalists will remain free to capture any personal data that are generally accessible to the public. Likewise, anything that takes place in public places or in public view can continue to be reported in the press. However, some would argue that individuals are entitled to a zone of privacy even in public places. Publishing without consent, a photograph of two lovers walking hand in hand on a beach might harm the couple if they are married but not to each other. Giving publicity to private facts in public records may also give rise to privacy concerns even though the records are accessible to the public. Most of these facts remain unknown to the public unless they are publicised by the press. The publication of such facts requires some restraint if the harm that may result from such disclosure outweighs the public benefits.

5.31 With the advent of the Internet, journalists can dig up the past life of individuals from the Internet. Fred Mann observes that a few web-sites have made a business out of compiling publicly available information about private citizens in the United States. Anyone, including journalists, can visit these sites and build a dossier on any individual at a modest cost. Besides, there is at least one web-site which allows anyone to see every posting any named individual has made to Internet Usenet groups. A casual comment or politically sensitive statement made to online discussion partners can easily be found and reported by the media.[277] Likewise, information about an individual who is at the centre of controversy can easily be reported world-wide by posting a message on the Internet. The implication is that private information, whether or not obtained by intrusive means, can, in principle, easily be put in the public domain by any individual with access to the Internet.

Conclusion

5.32 The recommendation in this chapter would go a long way meeting requirements to protect privacy in relation to gathering of news. However, in light of the inherent limitations of the Personal Data (Privacy) Ordinance and the restrictive scope of the privacy torts proposed in our Civil Liability Paper, we conclude that further measures are required to give more effective protection to individuals in the context of media intrusion. We shall examine in Chapter 6 whether the existing framework under the Broadcasting Authority Ordinance could be utilised to better protect individuals from intrusion by broadcasters. The problem of intrusion by newspaper and magazine publishers will be addressed in Chapter 7.

[270] Cap 486, section 50.
[271] Minutes of the meeting of the Panel on Information Policy of the Provisional Legislative Council held on 26 Sept 1997, para 27.
[272] Cap 486, section 13.
[273] Hong Kong Standard, 27 September 1997; South China Morning Post, 27 September 1997.
[274] Before approving the code, the Privacy Commissioner would be under a statutory duty to consult with bodies representative of data users to which the code would apply and “other interested persons”. In the case of guidelines for the news media, we take it to mean that members of the public would also be consulted in addition to journalists, editors and news proprietors.
[275] Above, para 30.
[276] The requirement that personal data be collected “lawfully” implies that the collection must not only be lawful in the strict sense but also be “fair in the circumstances”. The PDPO has rendered “unfair” collection, unlawful by virtue of DPP 1.
[277] F Mann, Philadelphia Online, “’New Media’ Brings a New Set of Problems” (1998), at <http://www.poynter.org/research/nm/nmmann98.htm> (30.4.98), p 3. The web-site monitors postings from various discussion groups and allows a visitor to search them by keyword or author. What were once perceived as private chats are now accessible to the public.

Hong Kong Law Reform Commission

Chapter 5 - Regulation under the Personal Data (Privacy) Ordinance

Personal Data (Privacy) Ordinance

Code of practice under the Personal Data (Privacy) Ordinance

Need for further measures to regulate media intrusion

Data Protection Principle 1

Data Protection Principle 3

Exemptions for the news media under section 61(1)

Privacy torts proposed in the Civil Liability Paper

Conclusion