[Previous] [Next] [Up] [Title]

Chapter 3 - Remedies under the Personal Data (Privacy) Ordinance


Data Protection Principles

3.1 The Personal Data (Privacy) Ordinance (Cap 486) was enacted to implement the recommendations of the Law Reform Commission contained in its report on Reform of the Law Relating to the Protection of Personal Data.132 The Ordinance has general provisions which seek to regulate the collection and use of personal data. It is important to bear in mind that the primary object of the Ordinance has been to regulate the collection and use of personal data, not to provide relief for invasion of privacy as such. A breach of a Data Protection Principle does not necessarily entail an invasion of privacy. Likewise, there may be an invasion of privacy without breaching a Data Protection Principle.

3.2 Data Protection Principle 1 in Schedule 1 to the Ordinance provides inter alia, that personal data shall be collected by means that are "lawful and fair in the circumstances of the case".[133] This principle does not cover all cases of invasion of privacy by intrusion. For example, A may search B or his premises without consent in order to find out more about C. Although B is a victim of A's intrusion, B has no remedy against A under the Ordinance because no recorded data have been collected to satisfy the requirement of the Ordinance.

3.3 As regards the use and disclosure of personal data, Data Protection Principle 3 provides that personal data may only be used for "the purpose for which the data were to be used at the time of the collection" or a directly related purpose unless the data subject consents otherwise. This Principle only limits the purpose of a disclosure or use of personal data; it does not aim at protecting the private life of individuals from unwanted publicity as such. In particular, it offers limited protection to people whose personal data are revealed in consequence of a crime, accident or tragedy. Personal data collected by journalists from public figures, victims and their friends and relatives are invariably for journalistic purposes. Journalists may argue that including these data in a newspaper or broadcast programme is consistent with the purpose for which the data were to be used at the time of the collection of the data. Hence individuals whose right of privacy has been infringed by the media publicising their data in connection with a newsworthy event may not have a remedy under the Ordinance if it was a journalist who had collected the data and the collection was lawful and fair in the circumstances.[134] In other words, as long as the data are collected lawfully and fairly and the publication is for the purpose for which the data were to be used at the time of the collection, the Ordinance would not restrain the publication even though it amounts to an invasion of privacy.

Administrative remedy

3.4 A person whose personal data have been collected or used in contravention of a data protection principle may request the Privacy Commissioner to investigate the matter. Where the Commissioner is satisfied that the data user is contravening a data protection principle, or has contravened such a principle "in circumstances that make it likely that the contravention will continue or be repeated", he may serve on the data user an enforcement notice directing him "to take such steps as are specified in the notice to remedy the contravention or, as the case may be, the matters occasioning it" within the specified period.[135] The Ordinance fails to provide any remedy where the complaint concerns an isolated contravention or there is merely a threat or an attempt to act in contravention of a data protection principle. It compares unfavourably to section 6 of the Hong Kong Bill of Rights Ordinance (Cap 383) which provides, inter alia, that the court may grant such remedy or relief in respect of a "threatened violation" as it has power to grant in the proceedings.

Civil remedy

3.5 Although the Ordinance does not make a breach of a data protection principle a tort, an individual who suffers damage by reason of a breach of a data protection principle relating to that individual's personal data is entitled to "compensation" from the data user.[136] It is not clear how "compensation" would be assessed except that "damage" includes injury to feelings. Thus any person whose personal data are collected or used in contravention of a data protection principle may seek compensation pursuant to the provisions of the Ordinance.[137]

3.6 Another limitation is that the Ordinance applies only to recorded data.[138] Its provisions will not operate to control visual and aural surveillance unless and until the data user has put the data acquired by such means "in a form in which access to or processing of the data is practicable".[139] As a result, a data subject may not have a claim against an eavesdropper or Peeping Tom who intrudes upon the privacy of another without using any recording device and without putting the data obtained by the intrusion in a recorded form. Similarly, an individual who has carried out a body search or who has searched the premises of another without consent is not liable under the Ordinance if the search process is not recorded.

3.7 Personal data held by an individual only for recreational purposes or which are concerned only with the management of his personal, family or household affairs are exempt from the Data Protection Principles.[140] However, these data may contain sensitive or embarrassing personal information about another. Under the Ordinance, as long as these data are intended to be and are in fact used by the data user for recreational purposes, their collection needs not comply with DPP 1 and the data user may use unfair means to collect them.

3.8 Another difficulty with enforcing the data protection principles under the Personal Data (Privacy) Ordinance relates to their content. As they are intended to be statements of principle, the data protection principles are expressed in general terms. The Privacy Commissioner has stated that Data Protection Principles 1 and 3 are open to wide interpretation. Paragraph 2 of Data Protection Principle 1, for instance, merely provides that personal data shall be collected by means which are "lawful" and "fair in the circumstances of the case". It fails to define in precise terms the circumstances under which liability would be imposed on wrongdoers. The Privacy Commissioner and the Court have a wide discretion in determining whether a collection or use constitutes a contravention.

3.9 The way the Ordinance is drafted also puts the complainant or plaintiff, as the case may be, in a disadvantageous position. The Ordinance places the burden on him to show that the data in question falls within the definition of "personal data" in the Ordinance. This requires him to satisfy the Privacy Commissioner or the Court that none of the specified exemptions applies to the data. The data user who is alleged to have contravened a data protection principle has no obligation to show that the collection or disclosure can be justified on one of the grounds prescribed in the Ordinance.

3.10 In the light of the limitations of the Personal Data (Privacy) Ordinance, it is clear that the Ordinance cannot always provide satisfactory relief to victims of invasion of privacy.[141]

132 Topic 27, 1994.

[133] The Privacy Commissioner is of the opinion that covert collection of personal information is considered to be generally unfair unless there is an overriding public interest. Furthermore, if the individual, whether he is a celebrity or not, makes it clear that he does not wish to be photographed, the collection would also be regarded as generally unfair. South China Morning Post, 27 September 1997.

[134] Although the media are not exempt from Data Protection Principle 1, section 61 of the Ordinance provides for an exemption for the disclosure of personal data to the media. As far as Data Protection Principle 3 is concerned, the exemption covers only the disclosure of personal data by a person to the newspaper proprietor or broadcaster. It does not apply to the subsequent publication or broadcasting even though doing so is in the public interest, unless publicising the data is consistent with the purpose for which the data were to be used at the time of collection, or a publisher or broadcaster can rely on one of the exemptions under Part VIII of the Ordinance (e.g. crime prevention or protection of health).

[135] Cap 486, section 50. For an overview of the Ordinance, see M Berthold & R Wacks, Data Privacy Law in Hong Kong (Hong Kong: FT Law & Tax Asia Pacific, 1997).

[136] Cap 486, section 66.

[137] See also paras 12.11 - 12.15.

[138] See the definition of "personal data" in section 2(1) of the Ordinance.

[139] Above. See HKLRC, Report on Reform of the Law Relating to the Protection of Personal Data (1994), paras 8.10 - 8.11.

[140] Section 52.

[141] See also Chapter 5 of the Consultation Paper on The Regulation of Media Intrusion (1999) published by the HKLRC Sub-committee on Privacy.

[Previous] [Next] [Up] [Title]