In response to the Law Reform Commission's Report on Privacy: The Regulation of Covert Surveillance (the LRC Report), the Privacy Commissioner for Personal Data, Mr. Roderick Woo ("the Commissioner") makes the following comments from the perspective of the Personal Data (Privacy) Ordinance (the Ordinance).

Not all forms of covert surveillance are regulated by the Ordinance. However, where the surveillance involves the collection of personal data, it falls within the purview of the Ordinance.

The LRC Report has raised important issues pertaining to the recognition of personal privacy rights and how those rights are to be protected.  Looking at the matter from the perspective of information privacy, as distinct from personal privacy, Mr. Woo urges legislator to consider whether the introduction of the two proposed offences will pose any potential conflict with the Ordinance.  Data Protection Principle ("DPP") 1(2) of the Ordinance requires that personal data shall be collected by means which are "lawful and fair in the circumstances of the case".  It follows that if covert surveillance involves the collection of personal data by unlawful means, the data user will be in breach of DPP1(2).  The Ordinance as it presently stands does not make the contravention of a data protection principle itself an offence whereas the Law Reform Commission recommends that similar conducts should be made a new offence.

"In view of the proposals made in the LRC Report, law makers may have to decide whether to legislate the proposed offences.  If they decide to do so, a review of the Ordinance need to be conducted in order to avoid creating any inconsistency in the law concerning information privacy." said Mr. Woo.

For covert surveillance carried out by the law enforcement agencies in circumstances in which a person is likely to have a reasonable expectation of privacy, the Law Reform Commission recommended that a regulatory system under which either a warrant or an internal authorization should be sought, depending on the degree of intrusiveness of the activity in question.  In acknowledging that covert surveillance is an effective tool that may be resorted to for the purpose of preventing or detecting serious crime or for safeguarding public security, the Commissioner considers it of paramount importance that all relevant legal requirements and procedures must be complied with, and to that end proper authorization be required for covert surveillance to be carried out, and that a supervisory authority equipped with adequate powers be set up to oversee compliance.

The Interception of Communications and Surveillance Bill currently under the scrutiny of the Legislative Council provides new legislative framework to regulate interception of communications and covert surveillance activities by law enforcement agencies.  The Commissioner considers that matters like the approval criteria, the frequency of the application for prescribed authorization, the appropriate approving authority for the renewal application, the management, retention and destruction of personal data obtained, and the notification to individuals whose personal data had been improperly collected should all be fully addressed.  His written comments have been sent to the Legislative Council and he hopes that members of the Bills Committee find them of assistance.