|
Hong Kong Law Reform Commission |
2.1 Although the Basic Law does not explicitly mention the right to privacy, Article 28 provides, inter alia, that "Arbitrary or unlawful search of the body of any resident or deprivation or restriction of the freedom of the person shall be prohibited." Article 29 supplements Article 28 by extending the protection against arbitrary or unlawful search from search of the body to search of or intrusion into the "home and other premises" of a resident.[52] The freedom and privacy of communication is also protected under Article 30. No department or individual may, on any grounds, infringe upon the freedom and privacy of communication except that the relevant authorities may inspect communication in accordance with legal procedures to meet the needs of public security or of investigation into criminal offences.
2.2 There is no common law tort of invasion of privacy.[53] A person whose privacy has been intruded upon has to show that the conduct of the intruder amounts to the commission of a well-recognised tort for which the victim has a cause of action. The protection of individual privacy is therefore incidental to the granting of relief for recognised torts. If the privacy-invasive act inflicting the injury is otherwise lawful, it does not give rise to an action for damages even though the act is inflicted maliciously and has caused embarrassment or emotional distress. Another difficulty is that the common law does not recognise any principle upon which compensation can be granted for mere injury to feelings. The plaintiff cannot maintain an action in tort unless the breach has caused him physical harm or psychiatric illness. We examine below to what extent privacy interests are protected by the recognised heads of tortious liability at common law.
2.3 The plaintiff has a cause of action in the tort of trespass to land when, without justification, the defendant enters on the plaintiff's land, remains on such land or places any object upon it. This tort can be used to protect the owner of premises from unjustified invasion of privacy if the invasion involves physical encroachment upon premises. This will be the case when the defendant installs a listening device inside the private premises of the plaintiff,[54]or when the defendant enters upon the plaintiff's premises to collect information without the plaintiff's consent. Hence entry onto premises by a television crew with cameras rolling will constitute trespass unless they have express or implied licence to enter. In Lincoln Hunt Australia Pty Ltd v Willesee, the court held that the implied licence for the public to visit commercial premises was:
"limited to members of the public bona fide seeking information or business with it or to clients of the firm, but not to people, for instance, who wished to enter to hold up the premises and rob them or even to people whose motives were to go onto the premises with video cameras and associated equipment or a reporter to harass the inhabitants by asking questions which would be televised throughout the State."[55]
Yet even if the plaintiff could obtain an injunction against trespass, he may not be able to obtain an injunction against publication of photographs or films obtained during the course of the trespass.[56]
2.4 The law of trespass protects a person's property and his enjoyment of it. It does not exist to protect his privacy as such. A person commits no trespass when he takes a sketch, photograph or videotape of someone else's property by standing on a public street or on adjoining property: a person does not commit a tort merely by looking.[57] Further, a court will not grant an injunction to prevent a landowner from opening windows which enables him to observe the activities of his neighbours.[58] Nor does a person have a right to prevent another taking a photograph of him even within his own premises. In Sports and General Press Agency Ltd v "Our Dogs" Publishing Co Ltd, the court refused to prevent the defendant publishing photographs taken at a dog show by an independent photographer. Horridge J held that:
"no one possesses a right of preventing another person photographing him any more than he has a right of preventing another person giving a description of him, provided the description is not libellous or otherwise wrongful."[59]
2.5 In Bernstein v Skyviews,[60] the defendant took aerial photographs of the plaintiff's house without the latter's consent and then offered the photographs for sale. The court did not grant an injunction restraining the defendant from entering the plaintiff's airspace. It held that a flight several hundred feet above the plaintiff's property did not interfere with his enjoyment of land, nor was the mere taking of a photograph without committing trespass on his land unlawful.[61]
2.6 The law of trespass is helpless where the surveillance is carried out from a distance. It does not protect individuals from eavesdropping with the aid of parabolic microphone where no wire-tapping or other physical intrusion upon plaintiff's property takes place. Likewise, it is not a trespass to listen in to another's telephone conversation as long as this does not involve physical encroachment upon the plaintiff's land.[62]
2.7 A further difficulty is that the law of trespass only protects plaintiffs who have a proprietary interest in land. A person who does not have any interest in land has no right to sue. The cause of action is therefore of no avail to guests, lodgers and hospital patients. The owner of the premises will have an action in trespass but he may be unwilling to bring it. Indeed, he may actually be the one who has placed a hidden surveillance device in the premises. Lastly, there can be no protection if the victim is in a public place.
2.8 The essence of the tort of nuisance is a condition or activity which unduly interferes with the use or enjoyment of land. The interference must continue for a prolonged period of time. An occupier may have a cause of action in private nuisance if he is harassed by telephone calls which cause him inconvenience and annoyance, thereby interfering with the ordinary and reasonable use of the property.[63] Likewise, watching and besetting premises may constitute a private nuisance.[64] However, the plaintiff could not maintain an action if there is only one isolated incident, or the property suffers no physical injury or the beneficial use of the property was not interfered with. A person who has taken a photograph of another cannot be liable in nuisance.
2.9 Subject to the exception that a person who is in exclusive possession of land could sue even though he could not prove title to it, a person who has no interest in the land could not sue in private nuisance. Thus a mere licensee on the land such as a lodger or member of the householder's family who has no right to exclusive possession does not have a right of action. An attempt to extend the protection afforded by this action to mere licensees was made in Khorasandjian v Bush.[65] There, the Court of Appeal held that harassment by unwanted telephone calls amounting to interference with the ordinary and reasonable enjoyment of property which the recipient of the calls had a right to occupy was actionable as a private nuisance, even though the recipient had no proprietary interest in the property. However, that decision was overruled by the House of Lords in Hunter v Canary Wharf Ltd.[66] Lord Hoffmann, now also a Non-Permanent Judge of the HK Court of Final Appeal, pointed out that the development of the common law should be rational and coherent: "It should not distort its principles and create anomalies merely as an expedient to fill a gap."[67] He said:
"If a plaintiff, such as the daughter of the householder in Khorasandjian v Bush, is harassed by abusive telephone calls, the gravamen of the complaint lies in the harassment which is just as much an abuse, or indeed an invasion of her privacy, whether she is pestered in this way in her mother's or her husband's house, or she is staying with a friend, or is at her place of work, or even in her car with a mobile phone. In truth, what the Court of Appeal appears to have been doing was to exploit the law of private nuisance in order to create by the back door a tort of harassment which was only partially effective in that it was artificially limited to harassment which takes place in her home. I myself do not consider that this is a satisfactory manner in which to develop the law, especially when … the step so taken was inconsistent with another decision of the Court of Appeal … ."[68]
2.10 The action in private nuisance is developed to protect private property or rights of property in relation to the use or enjoyment of land, rather than the privacy of the occupants and visitors. Although diminution of amenity value of the land will suffice, it is only if the victim's discomfort is caused by some act which adversely affects the value of some interest in the land to which he is entitled that the action can succeed.[69] This cause of action is also of limited use in protecting individuals against surveillance activities. A spy does not seek to interfere with the activities of his target; on the contrary he hopes that the activities will continue unchanged, so that he may observe or record them unnoticed. There can be no interference with the use of property if the occupier is not aware of the intrusion. In any event, the action affords no protection if the victim is in a public place.
2.11 Three elements appear to be necessary to succeed in an action for breach of confidence: (a) the information must have the necessary quality of confidence about it; (b) the information must have been imparted in circumstances importing an obligation of confidence; and (c) there must be an unauthorised use of that information to the detriment of the party communicating it.[70] A duty may arise if a person accepts the information on the basis that it will be kept secret or where a third party receives information from a person who is under a duty of confidence in respect of it and the third party knows that it has been disclosed to him in breach of confidence. Although most cases arise in a commercial or industrial context, revelation of marital confidencesor sexual conduct of an individual may be restrained through the remedy of breach of confidence.
2.12 It is worth noting that the law of breach of confidence in England and Wales has been developed in the light of obligations falling upon the Court under the UK Human Rights Act 1998. The following are some of the principles derived from recent cases:[71]
(a) If there is an intrusion in a situation in which a person can reasonably expect his privacy to be respected then that intrusion will be capable of giving rise to liability in an action for breach of confidence unless the intrusion can be justified.[72] The bugging of someone's home or the use of other surveillance techniques, such as a telephoto lens, are examples of such an intrusion.[73]
(b) It is unnecessary to show a pre-existing relationship of confidence where private information is involved. A duty of confidence will arise whenever the party subject to the duty is in a situation where he either knows or ought to know that the other person can reasonably expect his privacy to be protected. The existence of a relationship such as may create a duty of confidence may, and in personal confidence cases commonly will, have to be inferred from the facts.[74]
(c) An injunction may be granted to restrain the publication of photographs taken surreptitiously in circumstances such that the photographer is to be taken to have known that the occasion was a private one and that the taking of photographs by outsiders was not permitted.[75]
(d) Equity may intervene to prevent the publication of photographic images taken in breach of confidence. If, on some private occasion, the prospective claimant makes it clear, expressly or impliedly, that no photographic images are to be taken of him, then all those who are present will be bound by the obligation of confidence created by their knowledge (or imputed knowledge) of that restriction.[76]
2.13 Nonetheless, the action for breach of confidence aims at preserving confidentiality and the trust which the plaintiff has reposed in the confidant; it does not aim at protecting individuals from emotional distress and embarrassment caused by an infringement of his privacy. There are difficulties relying on this action to afford a remedy for unwarranted infringement of privacy:
(a) The courts have not laid down any criteria for determining what kinds of personal information would have the necessary quality of confidence about them, other than the negative requirement that the information must not be in the public domain.
(b) The law would not impose an obligation of confidence merely because the information relates to the private or sexual life of a person. For example, details of the treatment for drug addiction received by the applicant in Campbell v MGN[77] have been found to be too insignificant (compared with the fact that she was a drug addict) to warrant the court's intervention even though such information fell within the definition of "sensitive personal data" under the UK Data Protection Act.
(c) The concept of a relationship of confidentiality may well be inapplicable to transitory or commercial sexual relationships even though information relating to sexuality engages an intimate aspect of private life requiring special protection. Thus, where the parties are not married and one of them informs the media about their sexual relationship without the consent of the other party, the fact that the confidence was a shared confidence which only one of the parties wishes to preserve would undermine the other party's right to have the confidence respected. Extra-marital sexual relations would therefore lie "at the outer limits of relationships which require the protection of the law".[78] This is all the more so when the relationship is one between a prostitute in a brothel and her customer. The fact that they participate in sexual activity does not by itself constitute a sufficient basis for the attribution to the relationship of confidentiality. Details of the sexual activity between a prostitute and her customer have therefore been held to be not confidential, even though the latter would wish to keep them secret.[79] Thus, although the courts seem to have done away with the requirement of a pre-existing relationship to found an obligation of confidentiality, the fact that only one party would wish to keep the information private and confidential has deprived the claimants in A v B plc and Theakston v MGN Ltd of the protection under the law of confidence. The requirement of an agreement to keep the information confidential therefore renders actions for breach of confidence inadequate for the purposes of protecting an individual against invasion of privacy by unwarranted publicity.[80]
(d) Some private information is in the public domain but should nonetheless be protected from further disclosure from the privacy point of view. Images of a private individual in a public place taken without his knowledge and consent may relate to and impact on his private life, particularly when accompanied by a story revealing details of his private life.
(e) In Peck v UK,[81] the applicant was filmed by a local authority CCTV in a public street, brandishing a knife with which he had attempted to commit suicide. The authority later disclosed the footage and still images taken from the footage to the media, resulting in the applicant's images being published and broadcast. The UK Government suggested that the applicant would have been entitled to bring an action for breach of confidence if he had been filmed "in circumstances giving rise to an expectation of privacy on his part". But the European Court of Human Rights held that the applicant did not have an actionable remedy in breach of confidence and had no effective remedy before a UK court in relation to the disclosures by the local authority. The Court was not persuaded by the Government's argument that a finding that the applicant had an "expectation of privacy" would mean that the elements of the breach of confidence action were established. It was unlikely that the UK courts would have accepted that the images had the "necessary quality of confidence" about them, or that the information was "imparted in circumstances importing an obligation of confidence".[82]
(f) The fact that the information is obtained as a result of unlawful activities does not mean that its publication should necessarily be restrained by injunction on the grounds of breach of confidence, though this could well be a compelling factor when it comes to exercising discretion.[83]
(g) A person who acquires personal information in relation to another without notice of its confidential character (as when the information is not confidential by its nature) may disclose the information even though there is an agreement to keep it secret between the confider and the confidant.
(h) The requirement that the information must have been imparted in circumstances importing an obligation of confidence is problematic if the information was disclosed by a newspaper. The plaintiff would have to show that the newspaper had been put on notice prior to publication that the disclosure amounted to a breach of confidence owed by the source to the subject of the information. Accordingly, the plaintiff would have to show that the newspaper had the requisite notice both of the source's duty of confidence and of the source's breach of that duty. Such a duty will not exist in the majority of cases of media intrusion. Even if a duty of confidence exists in the particular case, it is difficult to prove because of the protection afforded to the media regarding their sources and the fact that information will often be provided to the media anonymously.
(i) There is no jurisdiction to grant an injunction as regards personal information already published. Once the information in question is in the public domain, its re-publication is not actionable as a breach of confidence. The obligation of confidence is discharged once the subject matter of the obligation has been destroyed, even though the destruction was the result of a wrongful act committed by the person under the obligation.[84] But private facts or photographs of an individual which have already been published in breach of his privacy may, on re-publication, cause him further distress, embarrassment and frustration.
(j) The law of breach of confidence is solely concerned with unauthorised disclosures. It offers no relief when the infringement does not involve, or result in, a disclosure. An intrusion into private premises or surveillance using an aural or visual device is not actionable as a breach of confidence.
2.14 There is an infringement of copyright if a person copies or publishes a private letter or family photograph the copyright of which is owned by another.[85] There are, however, limitations to protecting privacy under the law of copyright. An action for infringement of copyright is only actionable at the suit of the owner of the copyright, such as a photographer, the author of an article, or a television or newspaper company. A person whose photograph has been taken by another person cannot normally bring an action if the photograph is reproduced or published by that other person without his authority. An exception is if the person whose privacy has been invaded is also the person who has commissioned the photograph and he is entitled to the copyright under the terms of the agreement. A person who has commissioned a work may restrain any exploitation of the commissioned work for any purpose against which he could reasonably take objection.[86] But in situations where the publication of a photograph in a newspaper amounts to an invasion of privacy, the copyright of the photograph is usually owned by the newspaper company. There is also no copyright in a person's name, likeness or image; nor is there any copyright in information as such. A person may read a private letter and then reproduce the information contained in the letter in his own words without infringing the copyright of the author. Dissemination of information disclosed in an article would not constitute an infringement if there is no direct quotation. As for the tort of passing off, it exists to protect business goodwill, not privacy or personality as such.
2.15 A contract may expressly or impliedly restrict the use or disclosure of personal information furnished by a party to the contract. In Pollard v Photographic Company,[87] a photographer was restrained from using the plaintiff's photograph for advertising purposes. The court held that it was an implied term of the contract that prints taken from the negative of photographs taken at the defendant's shop were not to be used for an unauthorised purpose. It is open to the person who has been surreptitiously photographed by hotel staff when staying at a room in a hotel to argue that it is an implied term of the contract with the hotel that the room is free from surveillance by his staff.
2.16 A person who has wilfully done an act calculated to cause physical harm to another person without justification, and has in fact thereby caused physical harm to that person, is liable in tort under the principle laid down in Wilkinson v Downton.[88] False words and threats calculated to cause, uttered with the knowledge that they are likely to cause, and actually causing, physical harm to the person to whom they are uttered, are actionable.[89] The tort requires that the defendant intended the physical harm to be the consequence of the emotional distress suffered by the plaintiff, or was reckless as to whether this would be the consequence. Mental suffering or emotional distress by itself, although reasonably foreseeable, if unaccompanied by physical injury or recognisable psychiatric illness, is not a basis for a claim for damages,[90] nor would the defendant be liable if he did not have knowledge that the conduct in question was likely to cause physical harm.[91]
2.17 The action would not assist the individual aggrieved by an invasion of privacy in the majority of cases. Although the surreptitious use of a recording device in a person's premises and the publication of the details of his private life may cause him embarrassment or annoyance, it is only in extreme cases that physical or mental harm would ensue. Another difficulty is that a victim of invasion of privacy is rarely able to prove that the wrongful act was calculated to cause him physical harm or psychiatric illness; he is normally able to show that it is negligent at most.[92]
2.18 Trespass to the person consists of battery and assault. Battery is physical interference with the person of an individual. Touching an individual without his consent would be actionable. The taking of a photograph or the flashing of a light is not a battery, although it may well be the case if a bright light is deliberately shone into another person's eyes and injures his sight or damages him in some other way.[93] An assault is an overt action, by word or by deed, indicating an immediate intention to commit a battery and with the capacity to carry the threat into action.
2.19 In Home Office v Wainwright,[94] a man, M, and a woman, F, had been strip-searched, without real consent, by prison officers before they were allowed to visit a relative in prison. During the search, one officer examined M's naked body, lifted up his penis and pulled back the foreskin. F did not allege that she had been touched by the officers, but the room had an uncurtained window through which someone across the street could have seen her. At one point she was naked apart from her knickers around her ankles and a vest held above her breasts. As a result, M suffered from post-traumatic stress disorder and F's existing depression was exacerbated. The trial judge held that the tort of trespass to the person consisted of wilfully causing a person to do something to himself which infringed his right to privacy. However, Buxton LJ found that it was not a case of battery, but of causing the claimants to do something to themselves that led to humiliation and illness. He said extending the tort of trespass into the areas covered by Wilkinson v Downton and privacy was "unsupported by authority, entirely unprincipled, and if adopted would severely undermine the policy reasons for limiting the ambit of trespass".[95]
2.20 Defamation consists in the publication of a false statement which tends to damage the reputation of another without lawful justification. It might, for example, be defamatory if the defendant took a photograph of a person who wished to be let alone and published a photograph of him in fancy costume.[96] There are, however, differences between defamation and invasion of privacy. Whereas defamation protects the commercial interests of a natural or legal person, the law of privacy protects the personal right attached to a living individual. The basis of a defamation action is injury to a person's public reputation or status, not injury to an individual's emotions and mental suffering as in privacy cases. Since the primary damage in a complaint of unwanted publicity is the mental distress resulting from private facts having been exposed to public view, the published matter need not be defamatory in a privacy case. Another distinction between defamation and privacy is that truth is a complete defence to a defamation action. Defamation cannot afford a remedy where the offending statement is true. Since the primary object of privacy law is not to prevent inaccurate portrayal of private life, but to prevent its being depicted at all, defamation law is only marginally relevant to the protection of individuals from unwanted publicity; a fortiori when the invasion of privacy in question is unwarranted surveillance which does not involve any publication at all.
2.21 The tort of malicious falsehood consists in the defendant maliciously publishing statements about the plaintiff which are false, and the plaintiff suffering special damage as a result. The Younger Report gave the example of the malicious publication in a newspaper to the effect that a famous pop-singer had commenced his noviciate with a closed order of monks. The publication would not lower him in the esteem of right-thinking people, but would lose him engagements and therefore income, and therefore be actionable at his suit.[97] The tort has been developed to protect commercial interests.[98] An action for malicious falsehood would not avail the person whose personal information is accurately published in the newspaper.
2.22 One of the best cases to illustrate the failure of the common law to protect individual privacy is Kaye v Robertson.[99] The plaintiff was a well-known actor. He suffered severe injuries to his brain and was hospitalised in a private room which had a notice asking visitors to see a member of the staff before visiting. The defendant journalists ignored the notice and entered the room. Although the plaintiff apparently agreed to talk to them and did not object to them taking photographs inside the room, it was confirmed at the trial that he was in no fit condition to be interviewed or to give any informed consent to be interviewed.
2.23 The court held that there was no right to privacy in English law and accordingly there was no right of action for breach of a person's privacy. Invasion of a person's privacy, however gross, did not of itself entitle him to relief. The plaintiff therefore relied on the following causes of action: trespass to the person, passing off, libel, and malicious falsehood. The court agreed to grant an injunction for malicious falsehood: what was written in the article was false and the plaintiff's right to sell the story of the accident and his recovery would be seriously diminished if the defendants were able to publish their article.
2.24 The injunction granted on the basis of malicious falsehood afforded only limited protection. If the defendant had intended to publish the photographs alongside the story telling their readers the truth, namely that their photographer had entered the plaintiff's hospital room uninvited and the photographs had been taken without the plaintiff's consent, then no injunction could have been granted for malicious falsehood. As to the suggestion that the action could have successfully been based on a breach of confidence, Lord Bingham CJ was of the view that such a claim could not have successfully been made "without doing impermissible violence to the principles upon which that cause of action is founded."[100] As he pointed out, the complaint was not that information obtained or imparted in confidence was about to be misused, but that the plaintiff's privacy had been the subject of a monstrous invasion but for which the interview would never have been obtained at all.
2.25 The HK Bill of Rights Ordinance (Cap 383) incorporates into the law of Hong Kong the provisions of the International Covenant on Civil and Political Rights as applied to Hong Kong. As far as the right to privacy is concerned, Article 14 of the HK Bill of Rights states that no person shall be subjected to "arbitrary or unlawful interference with his privacy, family, home or correspondence", and that everyone has the right to the protection of the law against such interference.[101] The Ordinance makes no attempt to elaborate on the right to privacy under that Article.
2.26 Insofar as a court may grant remedy or relief in an action for breach of the HK Bill of Rights Ordinance,[102] it is arguable that the Ordinance has created a general right of privacy protecting an individual from arbitrary or unlawful interference with his privacy. However, the Ordinance binds only the Government and public authorities.[103] The right to privacy under the Ordinance cannot be enforced against private persons. The Article affords no protection to an individual whose right to privacy has been infringed by a private person.
2.27 Data Protection Principle (DPP) 1(1) provides that personal data must not be collected unless: (a) they are collected for a lawful purpose directly related to a function or activity of the data user who is to use the data; (b) the collection is necessary for or directly related to that purpose; and (c) the data are adequate but not excessive in relation to that purpose. DPP 1(2) requires that personal data shall be collected only by means which are both lawful and fair in the circumstances of the case. This means that a person is prohibited from collecting personal data by means that are unfair in the circumstances of the case, even if the means are lawful. For example, where personal data are collected by the use of deception, such a means of collection is likely to be treated as unfair if no public interest is at stake and hence contrary to DPP 1(2), even if the deception concerned is not unlawful. The Privacy Commissioner has advised that collection by means unknown to the individuals concerned (eg, photo-taking in public places using long-range lens or hidden cameras) is generally not considered to be a fair means of collection.[105] Other examples given by the Privacy Commissioner include the taking of photographs of individuals in private premises from outside without their consent, and the taking of photographs of individuals in public where they have made it clear that they do not wish to be photographed.[106] These means might nonetheless be considered fair if there is an over-riding public interest in the collection of personal data.[107]
2.28 Where personal data are collected from the individual who is the subject of the data (as may occur, for example, where a journalist records information given by an individual about himself during an interview), the provisions of DPP 1(3) require that all practicable steps shall be taken to inform the individual concerned of certain matters. In particular, the individual must be explicitly informed of the purpose for which the data are to be used.
2.29 The judgment of the Court of Appeal in Eastweek Publisher Ltd v Privacy Commissioner for Personal Data[108] has, however, limited the application of the various requirements of DPP 1 reviewed above to the collection of data relating to individuals whose identities are known to the collecting party or data of individuals the collecting party intends to identify (see below). Accordingly, where a person, say, photographs or films an individual whose identity is unknown and whom the photographer or film-maker does not intend to identify, the photographing or filming of the individual is not subject to the provisions of DPP 1, even though the subsequent use of the photograph or film may result in the individual being recognised and identified by his acquaintances.
2.30 DPP 2(1) requires that all practicable steps shall be taken to ensure that personal data are accurate having regard to the purpose for which the data are, or are to be, used. Given their time-sensitive nature, it will often be the case that there will be inaccuracies in personal data contained in news reports. However, so long as all practicable steps have been taken to check the accuracy of the personal data concerned, having regard to the fact that the purpose for which the data are to be used is news reporting, the requirements of DPP 2(1) will have been complied with.
2.31 DPP 2(1) also provides that where there are reasonable grounds for believing that personal data are inaccurate having regard to the purpose for which the data are, or are to be, used, the data concerned should either not be used for that purpose until those grounds cease to apply, or be deleted. Accordingly, a person who includes personal data in a document knowing that the data are inaccurate would be in breach of DPP 2(1). Further, where it is practicable in all the circumstances of the case to know that personal data disclosed to a third party were and are materially inaccurate having regard to the purpose for which the personal data are, or are to be, used by the third party, DPP 2(1) provides that all practicable steps shall be taken to inform the third party that the data are inaccurate and to provide the third party with such particulars as would enable the rectification of the data.
2.32 At first sight, it might appear that these requirements of DPP 2(1) would require a media organisation to publish or broadcast (as the case may be) corrections of reports that contained inaccurate personal data. Indeed, in our Report on Reform of the Law Relating to the Protection of Personal Data,[109], we recommended that the media be required to take all practicable steps to disseminate a correction where inaccurate data have been published.[110] On closer examination, however, it is doubtful whether DPP 2(1)'s requirement that recipients of inaccurate personal data be informed of corrections to that data are applicable to inaccurate personal data that have been broadcast or published to a general audience. This is because the relevant requirements of DPP 2(1) presuppose that the party that disclosed the personal data knows the purpose for which the data are, or are to be, used by each of the parties to whom the data have been disclosed. Such a presupposition does not seem to hold good for a publisher to a general audience, such as a newspaper publisher or broadcaster.[111] We are also not aware that anyone has sought to require that this be done in reliance on the provisions of DPP 2(1).
2.33 In Kam Sea Hang Osmaan v Privacy Commissioner for Personal Data[112], the Administrative Appeals Board was asked to consider a case in which an individual alleged that a magazine had published fabrications about him. The Board found, however, that a lie or fabrication about an individual falls outside the definition of personal data and, hence, that the provisions of the PD(P)O, including the provisions of DPP 2, did not apply at all in the case before it. Specifically, the Board said that:
"The wordings of the definition [of personal data in section 2(1) of the PD(P)O] are clear enough to exclude any fabrication or lies told about a person by another person. … A lie or fabrication always remains a lie or fabrication and can never convert into ‘personal data'."
2.34 With respect to the Board, there is no basis in the wording of the definition of personal data in section 2(1) of the PD(P)O for the contention that it excludes lies or fabrications. We also note that the Board's view would mean that the requirements of DPP 2, and the PD(P)O generally, apply where personal data are inaccurate as a result of inadvertence but not where the inaccuracy is deliberate. We cannot find any justification for such a distinction in the Ordinance. It is also at odds with our recommendation in our Report on Reform of the Law Relating to Personal Data (on which the PD(P)O was based)that all data relating to an individual that facilitate directly or indirectly the identification of the individual to whom they relate should be regulated by law "whether true or not".[113] A lie or fabrication is just as much an untruth as an inadvertent mistake. Accordingly, we respectfully consider that the views expressed by the Board on this matter are incorrect and hence that the application of DPP 2, and the PD(P)O generally, is not limited in the manner contended for by the Board in its decision referred to above.
2.35 DPP 3 provides that personal data must not, without the express consent of the data subject, be used for any purpose other than the purpose for which the data were to be used at the time of the collection of the data or a directly related purpose. As a general rule, compliance with the requirements of DPP 3 should pose little difficulty for journalists and media organisations because the personal data they publish or broadcast will usually have been collected for journalistic purposes. On the other hand, DPP 3 does pose potential problems for persons who wish to disclose personal data to journalists or media organisations. If such data were not collected by such persons for use for journalistic purposes or purposes directly related thereto, which will often be the case, then such disclosure would be contrary to the requirements of DPP 3 unless the express consent of the subject is obtained. To address this restriction, an exemption is provided for in the PD(P)O to permit the disclosure of personal data to journalists and media organisations where this is in the public interest. Specifically, in accordance with section 61(2) of the PD(P)O, journalistic sources are permitted to disclose personal data to a journalist or media organisation for publication or broadcasting if they have reasonable grounds to believe, and reasonably believe, that publication or broadcasting of the personal data concerned is in the public interest, even though such disclosure would otherwise contravene the requirements of DPP 3.
2.36 DPP 4 and DPP 5 provide respectively for various requirements with respect to the security of personal data and openness about the personal data policies and practices of persons who collect, hold, process or use personal data, and other matters. Like any other body, to the extent that a media organisation collects, holds, processes or uses personal data, it is subject to these requirements.
2.37 In Apple Daily v Privacy Commissioner,[114]the Administrative Appeals Board overturned a ruling by the Privacy Commissioner that the publisher of Apple Daily had breached DPP 4 by publishing the name of the street to which victims of an attack had moved out of fear of a further assault by their assailant. The basis for the Privacy Commissioner's decision was that the publication of the address in Apple Daily had put the individuals concerned at risk because their assailant might learn of their new location from the article and attack them again. The Privacy Commissioner concluded that this was a breach of DPP 4 because DPP 4 provides for a requirementto take all practicable steps to ensure that personal data are protected against unauthorised or accidental access having particular regard to the harm that could result from such access. The Privacy Commissioner ruled that Apple Daily had failed to meet this requirement by publishing the street name in the article.
2.38 The Administrative Appeals Board disagreed. It found that DPP 4 was intended to ensure that personal data are held in a secure manner. In publishing the personal data concerned, Apple Daily was using the data in such a way that the public would inevitably gain access to it and no question of "unauthorised or accidental" access arose. The Board concluded that: "Access is gained by reason of the publication and is not accidental in nature."
2.39 DPP 6 makes general provision for an individual to have the right to access and correct personal data of which he is the subject. These general provisions are elaborated upon in Part V of the PD(P)O, which contains detailed provisions on compliance with such data access and correction requests.[115] Potentially, the exercise of these rights by individuals who are the subjects of personal data collected by journalists or media organisations for journalistic purposes prior to publication or broadcasting of the personal data concerned could have an inhibiting effect on the journalistic process. To avoid this consequence, section 61(1) of the PD(P)O provides that personal data held by a person, whose business consists, in whole or in part, of a journalistic activity,[116] solely for the purpose of that activity, or a directly related activity, are exempt from the requirement to comply with data access requests unless and until the data are published or broadcast. The net effect of this exemption is that under the PD(P)O individuals have no right of access to, and correction of, their personal data held by journalists or media organisations for a journalistic purpose before the data concerned are published or broadcast.
2.40 An individual who believes that a person has breached any of the provisions of the PD(P)O, including the provisions of the DPPs, in relation to personal data of which he is the subject may make a complaint to the Privacy Commissioner.[117] However, in accordance with section 61(1) of the PD(P)O, where the data are held for the purpose of a journalistic activity, the Privacy Commissioner may not carry out an investigation of the complaint unless and until the personal data concerned have been published or broadcast. Further, in accordance with the same section, the Privacy Commissioner may not carry out an investigation of a suspected breach of the PD(P)O on his own initiative (ie in the absence of a complaint from the data subject or a person duly authorised on his behalf to make a complaint),[118] in relation to personal data held by a journalist or media organisation for the purpose of a journalistic activity, whether or not such data have been published or broadcast.[119]
2.41 If, having carried out an investigation of a complaint, the Privacy Commissioner concludes that the person concerned is contravening a requirement of the PD(P)O, including a requirement of the DPPs, or has contravened the PD(P)O and is likely to continue or repeat the contravention, he may serve an enforcement notice on that person.[120] Such a notice may direct the person on whom it is served to take such steps as are specified therein to remedy the contravention found by the Privacy Commissioner. For example, in a suitable case such a notice could require a person not to engage in a specified means of collecting personal data that the Privacy Commissioner has concluded is unfair in all the circumstances of the case. While a breach of a DPP is not by itself an offence,[121]a contravention of an enforcement notice is an offence,[122] as is a breach of any of the requirements of the main body of the PD(P)O.[123]
2.42 Where a data subject suffers damage, including injury to feelings, by reason of a contravention of the PD(P)O in relation to personal data of which he is the subject, he has a right to compensation for that damage.[124] To enforce this right the data subject must initiate legal proceedings. As far as is known, only one action involving a claim for compensation under the PD(P)O has been brought to trial.[125]
2.43 The PD(P)O contains a number of provisions to prevent its being used to interfere unduly with journalistic activities. By virtue of section 61(1) of the PD(P)O, the Privacy Commissioner may not carry out inspections of personal data systems used by media organisations. As already noted, by virtue of the same section he also cannot undertake an investigation on his own initiative into a possible breach of the Ordinance in relation to personal data held for the purpose of a journalistic activity, whether or not the data have been published or broadcast. Even where the Privacy Commissioner receives a complaint of such a contravention, he cannot investigate it unless and until the personal data concerned have been published or broadcast. In addition, where the Privacy Commissioner does exercise his investigatory powers within the aforementioned limits, journalists' sources are protected from disclosure by the provisions of section 44(2) of the PD(P)O. According to this section, a journalist cannot be compelled to disclose his source of information unless a judge of the Court of First Instance, on an application made by the Privacy Commissioner, directs the journalist to furnish the Commissioner with such information. Lastly, as also noted above, exemptions are provided for in the PD(P)O from: (a) the use limitation provisions of DPP 3 to enable the disclosure of personal data to journalists and media organisations where it is in the public interest for the data to be published or broadcast; and (b) the data subject's right of access to his personal data where the data are held for the purpose of journalistic activities unless and until the data are published or broadcast.[126]
2.44 Protection of privacy in relation to personal data - The object of the PD(P)O is to protect the privacy of individuals in relation to personal data by regulating the collection, holding, processing and use of personal data. It does not aim at protecting individuals from unwarranted privacy intrusion as such.[127] "Personal data" is defined as meaning any data:
"(a)relating directly or indirectly to a living individual;
(b)from whom it is practicable for the identity of the individual to be directly or indirectly ascertained; and
(c)in a form in which access to or processing of the data is [reasonably] practicable".[128]
"Data" is in turn defined as meaning "any representation of information (including an expression of opinion) in any document", and "document" is defined as including documents in writing and discs, films, tapes or other devices in which data are embodied and are capable of being reproduced.
2.45 Personal data relating to a living individual - Since the PD(P)O defines "personal data" as data relating to a living individual, bereaved relatives and friends have no right to complain under the Ordinance if personal data about their deceased relative or friend have been collected or used in a manner that would be a breach of the DPPs if the deceased were alive.
2.46 Information must be in a recorded form - By virtue of the definitions of personal data, data and document (see above), the PD(P)O does not apply to information relating to an individual that is not recorded. If the personal information disclosed by someone does not involve the disclosure of a record of the information or of information inferred from a record of the information, the disclosure does not constitute a disclosure of personal data within the meaning of the PD(P)O.[129] Likewise, if the personal information collected by someone is not subsequently put into a recorded form, the collection does not constitute a collection of personal data within the meaning of the Ordinance. Accordingly, information concerning an individual that is communicated orally is not subject to the provisions of the Ordinance so long as it has not been inferred from a written record. On the other hand, if such information is subsequently put into a recorded form (for example, written down or inputted into a computer file), it becomes personal data at that point and hence subject to the provisions of the PD(P)O provided it is practicable to identify the individual who is the subject of the information and the information is in a form in which access or processing is practicable.
2.47 By the same token, the PD(P)O does not operate to control visual or aural surveillance by an individual using only his own senses unless and until the information obtained by these means has been recorded and even then only if the resulting data meet all the other parts of the definition of personal data. Likewise, an individual who carries out a body search or who searches the premises of another without authority could not have any liability under the Ordinance.
2.48 Practicable to ascertain the identity of data subject - On its face, the requirement of the definition of personal data that it must be practicable to ascertain the identity of the individual to whom the data relate is a purely objective test to be applied by reference solely to the data concerned and without reference to any other information known by the party holding or receiving the data concerned. On this basis, a published article about an individual that does not directly identify him, and from which it is not practicable to identify him indirectly from the article alone, would not constitute personal data and hence would not be subject to the requirements of the Ordinance. This would be so even though the relatives or other acquaintances of the individual concerned are able to identify him indirectly through a combination of what is said in the article about him and their own knowledge of him. One example of this in this context is the publication of a photograph of an individual without otherwise identifying him in the related article. The individual's relatives and other acquaintances are able to identify him because they recognise him in the photograph but no one else is.
2.49 However, given that this part of the definition of personal data is given such fair, large and liberal construction and interpretation as will best ensure the attainment of the object of the PD(P)O,[130] the better view appears to be that account should be taken of other information that may be in the possession of the party holding or receiving the data concerned. On this basis, the photograph and accompanying article in the example given above (insofar as they relate to the individual concerned) would be considered personal data as far as the individual's relatives and other acquaintances are concerned. The Legal Director of the Privacy Commissioner's Office has expressed his personal view that where data about an individual are made available to third parties "generally" (as opposed to a specific party), it is "usually impossible" to give individual consideration to the question of whether a party who has thus acquired the data happens to possess other information which would render it practicable for him to ascertain the identity of the individual to whom the data relate.[131] While this is undoubtedly the case, it is reasonable to expect publishers to have general regard to the fact that their publications may be seen by persons, such as relatives or other acquaintances of the subjects of their articles, who have knowledge that would enable them to identify the subjects concerned, even though the articles do not directly identify them. Indeed, the reason why the facial features of individuals in photographs or film clips are commonly obscured in media reports is presumably to prevent their identification by persons whom the media organisation concerned reasonably believes may otherwise identify them.
2.50 The Eastweek case - In Eastweek Publisher v Privacy Commissioner for Personal Data,[132] the plaintiff's photographer took a photograph of the complainant in a public street. The photograph was later used to illustrate an article about women's fashion in Hong Kong, in which the complainant's dress sense was criticised. After a hearing as part of his investigation into the complaint, the Privacy Commissioner found inter alia that the photograph had been taken using a long-range lens without the complainant's knowledge or consent, and that after it appeared in the magazine concerned, the complainant's colleagues and others made fun of her and made her too embarrassed to wear the same clothing (which was new) again. As a result of his investigation into the complaint, the Privacy Commissioner concluded that there had been a breach of the requirement of DPP 1 to collect personal data by means that are fair in the circumstances of the case (ie that the taking of the photograph had been a collection of personal data by means that were unfair in the circumstances of the case).[133] The Court of First Instance upheld the Privacy Commissioner's finding on an application for judicial review.[134] However, a majority of the Court of Appeal held otherwise.[135]
2.51 Requirement to identify or intend to identify the data subject - DPP 1(2) provides inter alia that personal data shall be collected by means that are lawful and fair in the circumstances of the case. The Court of Appeal in the Eastweek case held that a contravention of DPP 1(2) requires two elements to be present: (a) an act of personal data collection; and (b) doing this by means which are unlawful or unfair in the circumstances. With respect to (a), a majority of the Court was of the view, as noted above, that it is of the essence of the required act of personal data collection that the data user must thereby be compiling information about "an identified person" or about "a person whom the data user intends or seeks to identify".[136] That this requirement is not expressly provided for in the Ordinance was explicitly recognised by one of the judges in the majority, Godfrey VP, thus: "I know this is not expressly spelled out in the legislation but I am satisfied from the way in which that legislation is framed that that is its underlying purpose …".[137] The majority further pointed out that if the identity of the person to whom the information relates is not known to the data user, then the latter could not comply with a data access or correction request under the Ordinance.[138]
2.52 The Court found that the photographer, the reporter and Eastweek remained completely indifferent to, and ignorant of, the complainant's identity right up to and after publication of the offending issue of the magazine. The Court therefore held (Wong JA dissenting) that taking her photograph did not constitute an act of personal data collection relating to the complainant. The fact that the photograph, when published, was capable of conveying the identity of the subject to a reader who happens to be acquainted with that person did not make the act of taking the photograph an act of data collection if the photographer and his principals were acting without knowing or being at all interested in ascertaining the identity of the person being photographed.[139]
2.53 Personal privacy vs information privacy - In the view of Ribeiro JA, as he then was, the complainant in the Eastweek case would be entirely justified in regarding the article and the photograph as an unfair and impertinent intrusion into her sphere of personal privacy.[140] Indeed, the Court of First Instance observed that the complainant's real complaint related to the invasion of her privacy, which the publication of her photograph in the magazine represented, rather than the unfair collection of data about her.[141] But as Ribeiro JA pointed out, the PD(P)O does not purport to protect "personal privacy" as opposed to "information privacy". The Ordinance is not intended to establish general privacy rights against all possible forms of intrusion into an individual's private sphere.[142] The complainant was therefore left without a remedy under the PD(P)O and the consequence of the principles laid down in Eastweek is that any individual whose privacy is intruded upon by a publication has no redress under the PD(P)O if the publisher has not identified and does not intend to identify the individual concerned.
2.54 Use Limitation Principle (DPP 3) - As far as the use and disclosure of personal data are concerned, DPP 3 provides that personal data may only be used for "the purpose for which the data were to be used at the time of the collection" unless the data subject consents otherwise. DPP 3 only limits the purpose of a disclosure or use of personal data; it does not aim at protecting the private life of individuals from unwarranted publicity as such. In particular, it offers limited protection to people whose personal data are revealed in consequence of a crime, accident or tragedy. Personal data collected by journalists from public figures, victims and their friends and relatives are invariably for journalistic purposes. Journalists may argue that including these data in a newspaper or broadcast programme is consistent with the purpose for which the data were to be used at the time of the collection of the data. Hence individuals whose right of privacy has been infringed by the media publicising their data in connection with a "newsworthy" event may not have a remedy under PD(P)O if it was a journalist who had collected the data and the collection was lawful and fair. As long as the data are collected lawfully and fairly and the publication is for the purpose for which the data were to be used at the time of the collection, the Ordinance will not restrain the publication even though it amounts to an unwarranted invasion of privacy.
2.55 Security Safeguards Principle (DPP 4) - As noted above, in Apple Daily v Privacy Commissioner,[143]the Administrative Appeals Board ruled that DPP 4 is not applicable to personal data when the data are used for publication. On the basis of this ruling, DPP 4 provides no protection for an individual the publication of whose personal data creates a risk that he may suffer harm from someone who "accesses" the data as a result of the publication.
2.56 Enforcement notices - The Privacy Commissioner does not have a power to award compensation to a person who suffers damage because of a contravention of a DPP, nor does he have the power to undertake proceedings on behalf of such a person. However, as noted above, a person who believes that there may have been a contravention of the PD(P)O with respect to his personal data may make a complaint to the Privacy Commissioner. As already noted in this context, however, the Privacy Commissioner's powers of investigation in relation to complaints against a media organisation are restricted to those concerning personal data that have been published or broadcast.[144] Where, following such an investigation, the Privacy Commissioner is satisfied that the person complained against is contravening the PD(P)O or has contravened it "in circumstances that make it likely that the contravention will continue or be repeated", he may serve on the person concerned an enforcement notice directing the person concerned "to take such steps as are specified in the notice to remedy the contravention" within the specified period.[145] However, other than his power to publish a report of the result of his investigation and make such recommendations or other comments as he thinks fit,[146] the Privacy Commissioner has no power to take further action against the party complained against where there is no likelihood of a further or continued contravention of the Ordinance.
2.57 Conclusion - The PD(P)O does not, and was not intended to, provide a comprehensive system of protection and redress for potential and actual victims of unwarranted privacy intrusion. The main reason for this is that the provisions of the PD(P)O are concerned only with privacy in relation to personal data, not privacy rights in general. Intrusive behaviour that does not involve the recording of information relating to identifiable individuals simply does not engage the Ordinance. The PD(P)O also has no application to data relating to deceased individuals.
2.58 Further, if a person collects data about an individual whose identity is unknown and there is no intention by that person to identify him, the collection of the data does not engage the provisions of the PD(P)O governing the collection of personal data. In addition, some provisions of the PD(P)O are not easily applied to personal data that are published generally or broadcast.[147] As noted above, the Administrative Appeals Board has pointed out the inapplicability of the security provisions of the Ordinance to personal data when they are so used. Generally published or broadcast personal data also do not appear to be susceptible to the application of the PD(P)O's provisions on the dissemination of corrections of inaccurate personal data.
2.59 Privacy Commissioner's views - The Consultation Paper concluded that the PD(P)O could not always provide satisfactory relief to victims of invasion of privacy. The Privacy Commissioner agreed that existing legislation and common law were not sufficient to provide adequate protection against privacy intrusion and unwanted publicity. In handling complaints under the PD(P)O, they sometimes encountered situations where there appeared to be no legal remedy for infringement of privacy. The Privacy Commissioner further agreed that although the two proposed torts would cover some situations already covered by the PD(P)O, the creation of a new cause of action should not be ruled out simply because it overlaps partly with an existing cause of action. In their opinion, what matters is how effective the new causes of action are likely to be in filling the existing gap in the law, and what other outcome (if any) their creation may lead to.
2.60 The Privacy Commissioner advised in his submission that there had been only one civil claim under section 66 of the PD(P)O, which had been dismissed as lacking in merits. This figure contrasts sharply with the number of complaints received by the Privacy Commissioner. The Commissioner offered the following reasons to explain why section 66 had been invoked so rarely:
(a) Most citizens are more inclined to lodge a complaint with an informal tribunal than to bring a lawsuit in view of the trouble and expense of the latter.
(b) There is not much to gain in bringing a civil action under section 66 because infringement of privacy rarely involves serious loss or damage.[148]
(c) In the absence of any successful claim under section 66, aggrieved individuals do not have any idea as to how the compensation would be assessed.
(d) Since the meaning of the Data Protection Principles is rather loose, a DPP is subject to a wide range of interpretation. The courts are not bound by the decisions and observations made by the Privacy Commissioner. It is hard to predict the outcome of a claim and an aggrieved individual cannot be sure that he has a good case.
2.61 Contrary to the position of the Equal Opportunities Commission under the Sex Discrimination Ordinance (Cap 480) and the Disability Discrimination Ordinance (Cap 487), the Privacy Commissioner does not have the power and resources to provide assistance to aggrieved individuals in respect of proceedings under section 66. Victims who have suffered damage by reason of a contravention of a DPP have to bear all the legal costs unless they are entitled to legal aid. We believe this is another reason why there have not been many cases under section 66.
2.62 A person who institutes proceedings under the Sex Discrimination Ordinance or the Disability Discrimination Ordinance may apply to the Equal Opportunities Commission for assistance in respect of these proceedings.[149] Such assistance may include (a) giving advice; (b) arranging for the giving of advice or assistance by a solicitor or counsel; (c) arranging for representation by a solicitor or counsel; and (d) any other form of assistance which the Commission may consider appropriate. We consider that similar provisions should be added to the PDPO in order that the Privacy Commissioner can provide assistance to data subjects who have suffered damage by reason of a contravention of a DPP.
|
Recommendation 1
We recommend that the Personal Data (Privacy) Ordinance (Cap 486) should be amended to enable the Privacy Commissioner for Personal Data to provide legal assistance to persons who intend to institute proceedings under section 66 of the Personal Data (Privacy) Ordinance, along the lines of section 85 of the Sex Discrimination Ordinance (Cap 480) and section 81 of the Disability Discrimination Ordinance (Cap 487). |
2.63 Although the HK Bill of Rights Ordinance has created a cause of action for breach of privacy against the Government or a public authority, the Hong Kong courts have thus far not recognised a legally enforceable right of privacy at common law. Where the HK Bill of Rights Ordinance is inapplicable, the interests in privacy have been protected only if another interest recognised by the courts has also been violated. Although some of the existing causes of action may incidentally afford some protection of privacy interests, their primary focus has been the protection of an individual's interest in his person or property. As privacy interests are wider in scope than the interests recognised by the existing torts, the protection of privacy by common law is "patchy and inadequate".[150] We consider that the protection of privacy interests should not be confined to "parasitic damages" arising out of defamation and injury to contractual or proprietary rights.[151] In its report on privacy, the British section of JUSTICE concluded:
"English law does … provide a remedy for some kinds of intrusion into privacy, but it is certainly not adequate to meet the activities of a society which is perfecting more and more sophisticated techniques for intrusion. The present law in the field of privacy is unco-ordinated and unsatisfactory, and a strong case in our view exists for the creation by means of statutory provision of comprehensive protection for the right of privacy."[152]
2.64 Basil Markesinis says:
"English law, on the whole, compares unfavourably with German law. True, many aspects of the human personality and privacy are protected by a multitude of existing torts, but this means fitting the facts of each case in the pigeon-hole of an existing tort and this process may not only involve strained constructions; often it may also leave a deserving plaintiff without a remedy".[153]
2.65 Leggatt LJ made the following observation in Kaye v Robertson after referring to the law of privacy in the US:
"We do not need a First Amendment to preserve the freedom of the press, but the abuse of that freedom can be ensured only by the enforcement of a right to privacy. This right has so long been disregarded here that it can be recognised now only by the legislature. Especially since there is available in the United States a wealth of experience of the enforcement of this right both at common law and also under statute, it is to be hoped that the making good of this signal shortcoming in our law will not be long delayed."[154]
2.66 Apart from the US, the laws of many jurisdictions recognise the right of privacy in one way or another. But since the US is the first common law jurisdiction to treat invasion of privacy as a tort, more American authorities are cited in the remaining part of the report than those from other jurisdictions. However, although American authorities are instructive as to the ingredients of a tort of invasion of privacy, the impact of the First Amendment on the US Constitution has resulted in an approach which cannot be directly transplanted to Hong Kong. American authorities must be used with caution in developing the principles governing the law of privacy in Hong Kong.[155]
[52] These provisions are reminiscent of the Fourth Amendment to the US Constitution, which provides that "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated". The function of the Fourth Amendment is to protect individual privacy and dignity against unwarranted intrusion by the state. It was originally applied to afford protection to tangible items as represented by persons, houses, papers and effects. But in recent years, the courts have construed it to mean that an individual has a reasonable expectation of privacy to be free from intrusion of electronic surveillance. It is open to the Hong Kong courts to adopt a liberal interpretation to construe Articles 28 and 29 of the Basic Law as providing Hong Kong residents with a right to be protected against unwarranted invasion of privacy by private persons and the Government.
[53] Malone v MPC [1979] Ch 344; Kaye v Robertson [1991] FSR 62 (CA); Khorasandjian v Bush [1993] QB 727, 744 (CA); Home Office v Wainwright [2002] QB 1334 (CA); Wainwright v Home Office [2003] UKHL 53, [2003] All ER (D) 279 (Oct). The House of Lords in the last case pointed out at para 31 that there was a great difference between identifying privacy as a value which underlies the existence of a rule of law (and may point the direction in which the law should develop) and privacy as a principle of law in itself. In Douglas v Hello! Ltd (No 3) [2003] EWHC 786 (Ch), [2003] 3 All ER 996, Lindsay J said at para 229: "It is notorious that, as our law was before the Human Rights Act [1998], there was no effective law of privacy; there was nothing to fill such gaps as might exist when neither the law of confidence nor any other law protected a claimant."
[54] Sheen v Clegg, (1967) Daily Telegraph, 22 June; Greig v Greig [1966] VR 376.
[55] (1986) 4 NSWLR 457, at 460.
[56] Kaye v Robertson [1991] FSR 62. In R v Central Independent Television plc [1994] 3 WLR 20, the defendant obtained some footage of an arrest of an alleged paedophile which took place on private property. Although the issue of trespass was not before the Court, Neill LJ suggested at p 29 that the defendant was "entitled to publish the programme in full, and ... there was no legal bar to prevent them from including pictures of the place of arrest". Cf Emcorp Pty Ltd v Australian Broadcasting Corporation [1988] 2 Qld R 169. The Court in that case granted an injunction on the grounds that the audio-visual material obtained by the defendants were obtained in flagrant disregard of the plaintiff's property rights and at a time when the defendants were trespassing.
[57] Hickman v Maisey [1900] 1 QB 752; Re Penny (1867) 7 E & B 660. In Victoria Park Racing and Recreation Grounds Co Ltd v Taylor (1937) 58 CLR 479 at 494, Latham CJ held that the defendant did no wrong to the plaintiff by describing to as wide an audience as he could obtain, what took place on the plaintiff's ground
[58] Turner v Spooner (1861) 30 L J Ch 801. The Court in Tapling v Jones (1865) 11 HLC 290 at 305 held that "invasion of privacy by opening windows" was not a wrong for which the law would give a remedy.
[59] [1916] 2 KB 880; affirmed by the Court of Appeal in [1917] 2 KB 125. The landowner may prohibit the taking of photos in his premises by making it a condition of entry.
[60] [1978] QB 479.
[61] Section 8(1) of the Civil Aviation Ordinance (Cap 448) provides that no action shall lie in respect of trespass or nuisance by reason only of the flight of an "aircraft" over any property at a reasonable height above the ground.
[62] Malone v Commissioner of Police of the Metropolis (No 2) [1979] 2 All ER 620 at 642-644.
[63] Khorasandjian v Bush [1993] QB 727.
[64] Hubbard v Pitt [1976] 1 QB 142.
[65] [1993] 3 All ER 669, [1993] 3 WLR 476 (CA).
[66] [1997] 2 All ER 426.
[67] Above, at 452g.
[68] Above, at 438c.
[69] Hunter v Canary Wharf Ltd [1997] 2 All ER 426; affirmed in Ng Hoi Sze v Yuen Sha Sha [1999] 3 HKLRD 890, 895 - 896.
[70] Koo Chih Ling (Linda) v Lam Tai Hing [1994] 1 HKLR 329; Li Yau-wai, Eric v Genesis Films Ltd [1987] HKLR 711.
[71] See generally Douglas v Hello! Ltd (No 3) [2003] EWHC 786 (Ch), [2003] 3 All ER 996, para 186.
[72] A v B plc [2002] EWCA Civ 337, [2002] 2 All ER 545 (CA), para 11(x); Venables v Newsgroup Newspapers Ltd [2001] 1038, para 81.
[73] Theakston v MGN Ltd [2002] EWHC 137 (QB), paras 77-80.
[74] A v B plc [2002] EWCA Civ 337, [2002] 2 All ER 545 (CA), para 11(ix); Attorney-General v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109, 281.
[75] Douglas v Hello! Ltd [2001] 2 WLR 992 (CA), paras 68-69; citing Creation Records Ltd v News Group Newspapers Ltd [1997] EMLR 444 and Shelley Films Ltd v Rex Features Ltd [1994] EMLR 134.
[76] Douglas v Hello! Ltd [2001] 2 WLR 992 (CA), para 71.
[77] [2002] EWCA Civ 1373, paras 56-58 .
[78] A v B plc [2002] EWCA Civ 337, [2002] 2 All ER 545, paras 11(xi), 43(iii) and 47.
[79] Theakston v MGN Ltd [2002] EWHC 137 (QB), paras 57-64 and 72-76; endorsed by the Court of Appeal in A v B plc, above.
[80] G Phillipson, "Transforming Breach of Confidence? Towards a Common Law Right of Privacy under the Human Rights Act" (2003) 66 MLR 726, 744-748 and 757-758.
[81] No 44647/98, date of judgment: 28.4.2003 (ECtHR).
[82] No 44647/98, date of judgment: 28.4.2003 (ECtHR), paras 95, 110-111.
[83] A v B plc [2002] EWCA Civ 337, [2002] 2 All ER 545, para 11(x); citing Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd [2001] HCA 63.
[84] See J Morgan, "Privacy, Confidence and Horizontal Effect: ‘Hello' Trouble" [2003] CLJ 444, 452-3; Attorney-General v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109, 265, 286-287.
[85] An author also has two "moral rights" under the Copyright Ordinance (Cap 528), namely, the right to be identified as the author (s 89) and the right to object to derogatory treatment of his work (s 92).
[86] Copyright Ordinance (Cap 528), s 15.
[87] (1889) 40 Ch D 345.
[88] Wilkinson v Downton [1897] 2 QB 57, 59.
[89] Janvier v Sweeney [1919] 2 KB 316, 322; Wong Kwai Fun v Li Fung [1994] 1 HKC 549.
[90] Alcock v Chief Constable of South Yorkshire Police [1992] 1 AC 310; Khorasandjian v Bush [1993] 3 WLR 476, 482H-483A; Wainwright v Home Office [2003] UKHL 53, para 47.
[91] Home Office v Wainwright [2001] EWCA Civ 2081, [2002] QB 1334.
[92] Hosking v Runting [2003] 3 NZLR 385, para 173 ("In many cases, particularly those involving the media, it is quite unlikely that a media organisation intends to harm a plaintiff when it publishes private information about that person. It is much more likely … that the intention would be to impart information to the public and to maintain circulation.")
[93] Kaye v Robertson and Sport Newspaper Ltd [1991] FSR 62.
[94] [2001] EWCA Civ 2081, [2002] QB 1334.
[95] [2001] EWCA Civ 2081, [2002] QB 1334, para 72.
[96] Monckton v Ralph Dunn [1907] The Times, 30 January. The plaintiff in the following cases was found to have a cause of action in defamation: a dental advertisement showing a picture of a young actress as if she had no teeth: Funston v Pearson [1915] The Times, 12 March; a photograph in a newspaper of a person on a hot day, with a caption implying that his feet would smell so badly at the end of the day that they would need to be soaked in the defendant's disinfectant: Plumb v Jeyes Sanitary Compounds Co Ltd [1937] The Times, 15 April; an advertisement showing the face of the plaintiff, who did not seek publicity, mounted upon the body of a man dressed in a foppish manner, carrying a cane and eye-glass: Dunlop Rubber Co Ltd v Dunlop [1921] AC 347.
[97] Younger Report, Annex I, para 8.
[98] Examples are actions for "slander of title" and "slander of goods".
[99] [1991] FSR 62; B S Markesinis, "Our Patchy Law of Privacy - Time to do Something about it"(1990) 53 MLR 802; P Prescott, "Kaye v Robertson - a reply" (1991) 54 MLR 451.
[100] Lord Bingham of Cornhill, "Opinion: Should There Be a Law to Protect Rights of Personal Privacy?" [1996] 5 EHRLR 450, 457.
[101] Hong Kong Bill of Rights Ordinance (Cap 383), Part II. On Article 14 generally, see X v The Commissioner of the Independent Commission Against Corruption, HCCM 49/2003, paras 14 - 20.
[102] Cap 383, section 6.
[103] Cap 383, section 7.
[104] See generally M Berthold and R Wacks, Hong Kong Data Privacy Law - Territorial Regulation in a Borderless World (Sweet & Maxwell Asia, 2nd edn, 2003).
[105] Minutes of the Meeting of the Panel on Information Policy of the Provisional Legislative Council held on 26.9.97, para 27.
[106] Above.
[107] Above.
[108] [2000] 1 HKC 692.
[109] August 1994.
[110] Above, para 18.50.
[111] Similar arguments apply with respect to the provisions of s 23(1) of the PD(P)O, which require that corrections of personal data made pursuant to a data correction request be notified to third parties to whom the data had been disclosed within the previous 12 months unless there is reason to believe they have ceased to use the data for the purpose for which the data were disclosed. These arguments are set out in Ch 11.
[112] Administrative Appeal No 29 of 2001, unreported decision of the Administrative Appeals Board dated 28.2.02.
[113] August 1994, para 8.17.
[114] Administrative Appeal No 5 of 1999, unreported decision of the Administrative Appeals Board dated 30.11.99, discussed in R Wacks, "Privacy and Process" (1999) 29 HKLJ 176.
[115] To the extent, if any, that there is an inconsistency between the provisions of DPP 6 and Part V of the PD(P)O, the latter prevail by virtue of s 4 of the PD(P)O.
[116] By virtue of the definition of "news activity" in s 61(3) of the PD(P)O all journalistic activities, including the gathering of news and various other news related activities are covered by the relevant provisions.
[117] Pursuant to s 37 of the PD(P)O.
[118] Pursuant to s 37(1) of the PD(P)O, a "relevant person" may make a complaint to the Commissioner about a possible contravention of the Ordinance on behalf of the individual who is the subject of the personal data concerned; a "relevant person" is defined in s 2(1) of the Ordinance.
[119] In addition, if the Commissioner wishes to require a media organisation to reveal the source of personal data that are the subject of an investigation and are held for a news activity, pursuant to s 44(2) of the PD(P)O he must first obtain an order to this effect from the Court of First Instance.
[120] Section 50 of the PD(P)O.
[121] Section 64(10) of the PD(P)O.
[122] Section 64(7) of the PD(P)O, the maximum penalty on conviction is a fine at level 5 and imprisonment for 2 years.
[123] Section 64(10) of the PD(P)O, the maximum penalty on conviction is a fine at level 3.
[124] Section 66 of the PD(P)O.
[125] Kwan Chi-shan v Yeung Yin-fang DCCJ 7812 of 1997 (Unreported judgment of Judge CB Chan) (4.12.97).
[126] Section 61(1) of the PD(P)O refers.
[127] See the long title and the remarks of Ribeiro JA (as he then was) at 704I to 705E of Eastweek Publisher Ltd v Privacy Commissioner for Personal Data [2000] 1 HKC 692.
[128] Section 2(1) of the PD(P)O.
[129] Under s 2(1) of the PD(P)O, disclosing in relation to personal data includes disclosing information inferred from the data.
[130] In accordance with s 19 of the Interpretation and General Clauses Ordinance (Cap 1).
[131] E Pun, "Meaning of ‘personal data' and ‘collection' in the PD(P)O", collected in E-Privacy in the New Economy - Conference Presentations (Hong Kong: Office of the Privacy Commissioner for Personal Data, 2001), <www.pco.org.hk/english/infocentre/ speech_20010326.html>, p 102.
[132] [2000] 1 HKC 692. Cf Aubry v Éditions Vice-Versa Inc, 157 DLR(4th) 577.
[133] Above, per Ribeiro JA (as he then was) at 696C.
[134] Eastweek Publisher Ltd v Privacy Commissioner for Personal Data,HCAL 98 of 1998 (Unreported judgment of Keith JA, sitting as an additional judge of the Court of First Instance) (24.9.99).
[135] [2000] 1 HKC 692; Godfrey VP and Ribeiro JA (as he then was) in the majority, Wong JA dissenting.
[136] Above, per Ribeiro JA (as he then was) at 700A-B and per Godfrey VP at 711D.
[137] Above, at 711D-F.
[138] Above, per Ribeiro JA (as he then was) at 702D-703H.
[139] Above, per Ribeiro JA (as he then was) at 702B-D.
[140] Above, at 705H-I.
[141] Eastweek Publisher Ltd v Privacy Commissioner for Personal Data, above, at 17E-H.
[142] [2000] 1 HKC 692 at 704I to 705B.
[143] Administrative Appeal No 5 of 1999.
[144] Section 61(1) of the PD(P)O.
[145] Section 50 of the PD(P)O.
[146] Section 48 of the PD(P)O.
[147] The concept of 'fair use or disclosure' (as opposed to 'fair collection') is lacking in DPP 3 (which implements the Purpose Limitation Principle in the OECD Privacy Guidelines 1980). Cf Article 6(a) of the EU Data Protection Directive 1995, which requires that personal data must be 'processed' (a term defined as including 'use, disclosure by transmission, dissemination or otherwise making available') not only lawfully but also 'fairly'; and Article 7 which sets out the principles relating to the reasons for making 'processing' legitimate.
[148] Although the amount of damages for injury to feelings may be small in the past, three plaintiffs, who sought redress for unlawful discrimination under the Disability Discrimination Ordinance, obtained substantial damages for injury to feelings recently. In K, Y and W v Secretary for Justice (DCEO Nos 3, 4, 7 of 1999), K and Y were each awarded $100,000 under that head while W was awarded $150,000. Similarly, the plaintiff in Yuen Sha Sha v Tse Chi Pan (DCEO No 1 of 1998) obtained $80,000 for sexual harassment under the Sex Discrimination Ordinance. It appears that the view that there is not much to gain in bringing a civil action under s 66 of the PDPO should be adjusted.
[149] Cap 480, s 85 & Cap 487, s 81. There were 11 District Court cases under the two Ordinances in 1999. About half of them were assisted by the EOC.
[150] Lord Bingham of Cornhill, "The Way We Live Now: Human Rights in the New Millennium" [1998] 1 Web JCLI.
[151] G Dworkin, "Privacy and the Press" (1961) 24 MLR 185, 187.
[152] JUSTICE, Privacy and the Law (London, Stevens and Sons, 1970), para 85.
[153] B S Markesinis, A Comparative Introduction to the German Law of Torts (Oxford: Clarendon Press, 3rd edn, 1994), 416.
[154] Kaye v Robertson, at 71.
[155] See Godfrey v Demon Internet Ltd [2000] 3 WLR 1020, 1022 (observing that care has to be taken before American cases are applied in English defamation cases).