The Privacy Commissioner for Personal Data (the Commissioner) Mr. Roderick B. Woo published today a report (the Report) on the result of an investigation of the alleged disclosure by an email service provider in Hong Kong of its account subscriber's personal data.
The investigation finds no contravention of the Personal Data (Privacy) Ordinance (the Ordinance) and yet gives rise to concern about the scope of application of the Ordinance.
"It became evident to me in the course of the investigation that certain provisions of the Ordinance should be clarified for better performance of the Commissioner's regulatory function. A clearer interpretation and application of the Ordinance will enhance the overall effectiveness in the protection of personal data privacy. To this end, my Office is proposing a legislative review of the Ordinance and hope that the Government will facilitate the legislation amendment process." Mr. Woo said.
Background
In October 2005, local newspapers reported that a mainland journalist, Mr. X, was convicted by a PRC Court of the crime of providing State secrets to foreign entities. A Hong Kong email service provider, Yahoo!Hong Kong Limited (YHKL), was alleged to have disclosed Mr. X's personal data to the PRC law enforcement authorities which eventually led to Mr. X's arrest and conviction.
As email service providers collect and hold a massive amount of email account holders' personal data, this incident aroused public concern about the protection of email subscribers' personal data privacy, in particular where disclosure is made in compliance with a lawful order issued by a foreign authority under foreign law for purpose of investigation of a foreign crime.
Commissioner's action
On 21 October 2005, the Commissioner took the initiative to probe into the matter to determine whether there had been a breach of the Ordinance. Subsequently, the Commissioner received a complaint lodged by an authorized representative of Mr. X alleging that YHKL had disclosed Mr.X's personal data to the PRC authorities without his consent. The Commissioner decided to carry out an investigation pursuant to section 38 of the Ordinance on 9 May 2006.
The investigation
The focus of the investigation was to find out whether any personal data of Mr. X was disclosed by YHKL; if yes, whether the disclosure had contravened Data Protection Principle 3 of the Ordinance; and whether such disclosure could be exempted under section 58 of the Ordinance.
The course of investigation was difficult due to the lack of supporting evidence provided by the complainant, and the limited information or evidence that could be gathered. As the act of collection, holding, processing and use of the personal data in relation to the business operation of Yahoo!China which was owned by YHKL apparently took place in the PRC, legal advice was sought from two PRC law experts on the applicability of the PRC laws and from a local Senior Counsel on the scope of application of the Ordinance.
Findings of the investigation
Having considered all the circumstances of the case, the Commissioner concluded that there was insufficient evidence to prove that Mr. X's personal data were disclosed by YHKL to the PRC authorities. Hence there had been no contravention of the requirements of the Ordinance by YHKL.
(For details of the legal grounds considered by the Commissioner, which involved mixed questions of facts and laws, please refer to the body of the Report.)
No enforcement notice was issued in consequence of the investigation.
Commissioner's comments arising from the investigation
The investigation of the case highlights the need to have more clear-cut answers to the following questions:
(a) Should the Ordinance apply where none of act of collection, holding, processing and use of the personal data takes place in Hong Kong?
(b) Should the Ordinance apply where the disclosure of personal data is made in compliance with a lawful order issued by a foreign authority under foreign law for the purpose of investigation of a foreign crime.
The Commissioner shall bring to the attention of the Home Affairs Bureau issues emanating from the Report for Government's due consideration.
Copies of the Report are available from the Commissioner’s Office at 12/F, Sunlight Tower, 248 Queen's Road East, Wan Chai, Hong Kong. They are also available for download from the website of the Commissioner's Office (www.pcpd.org.hk/english/enforcement/commissioners_findings/investigation_reports/invest_report.html).
END