14 March 2007
Commissioner released investigation report against email service
The Privacy Commissioner for
Personal Data (the Commissioner) Mr. Roderick B. Woo published today a
report (the Report) on the result of an investigation of the alleged
disclosure by an email service provider in Hong Kong of its account
subscriber's personal data.
The investigation finds no contravention of the Personal Data (Privacy)
Ordinance (the Ordinance) and yet gives rise to concern about the scope
of application of the Ordinance.
"It became evident to me in the course of the investigation that
certain provisions of the Ordinance should be clarified for better
performance of the Commissioner's regulatory function. A clearer
interpretation and application of the Ordinance will enhance the
overall effectiveness in the protection of personal data privacy.
To this end, my Office is proposing a legislative review of the
Ordinance and hope that the Government will facilitate the legislation
amendment process." Mr. Woo said.
In October 2005, local newspapers reported that a
mainland journalist, Mr. X, was convicted by a PRC Court of the crime
of providing State secrets to foreign entities. A Hong Kong email
service provider, Yahoo!Hong Kong Limited (YHKL), was alleged to have
disclosed Mr. X's personal data to the PRC law enforcement authorities
which eventually led to Mr. X's arrest and conviction.
As email service providers collect and hold a massive amount of email
account holders' personal data, this incident aroused public concern
about the protection of email subscribers' personal data privacy, in
particular where disclosure is made in compliance with a lawful order
issued by a foreign authority under foreign law for purpose of
investigation of a foreign crime.
On 21 October 2005, the Commissioner took the
initiative to probe into the matter to determine whether there had been
a breach of the Ordinance. Subsequently, the Commissioner
received a complaint lodged by an authorized representative of Mr. X
alleging that YHKL had disclosed Mr.X's personal data to the PRC
authorities without his consent. The Commissioner decided to
carry out an investigation pursuant to section 38 of the Ordinance on 9
The focus of the investigation was to find out whether any personal
data of Mr. X was disclosed by YHKL; if yes, whether the disclosure had
contravened Data Protection Principle 3 of the Ordinance; and whether
such disclosure could be exempted under section 58 of the Ordinance.
The course of investigation was difficult due to the lack of supporting
evidence provided by the complainant, and the limited information or
evidence that could be gathered. As the act of collection,
holding, processing and use of the personal data in relation to the
business operation of Yahoo!China which was owned by YHKL apparently
took place in the PRC, legal advice was sought from two PRC law
experts on the applicability of the PRC laws and from a local Senior
Counsel on the scope of application of the Ordinance.
Findings of the
Having considered all the circumstances of the case,
the Commissioner concluded that there was insufficient evidence to
prove that Mr. X's personal data were disclosed by YHKL to the PRC
authorities. Hence there had been no contravention of the
requirements of the Ordinance by YHKL.
(For details of the legal grounds considered by the Commissioner, which
involved mixed questions of facts and laws, please refer to the body of
No enforcement notice was issued in consequence of the investigation.
comments arising from the investigation
The investigation of the case highlights the need to have more
clear-cut answers to the following questions:
(a) Should the Ordinance apply where none of act of
collection, holding, processing and use of the personal data takes
place in Hong Kong?
(b) Should the Ordinance apply where the disclosure
of personal data is made in compliance with a lawful order issued by a
foreign authority under foreign law for the purpose of investigation of
a foreign crime.
The Commissioner shall bring to the attention of the Home Affairs
Bureau issues emanating from the Report for Government's due
Copies of the Report are available from the Commissioner’s Office at
12/F, 248 Queen's Road East, Wan Chai, Hong Kong. They are also
available for download from the website of the Commissioner's Office
Copyright © Office of the Privacy Commissioner for Personal
Data, Hong Kong. All rights reserved. Disclaimer