Review of Proposed Legislation

Section 8(1)(d) of the Ordinance requires the Privacy Commissioner to examine any proposed legislation that he considers may affect the privacy of individuals in relation to personal data, and to report the results of his examination to those parties proposing the legislation. To enable the Privacy Commissioner to carry out this function, all policy bureaux of the Hong Kong SAR Government have been asked to ensure that legislative proposals that may affect personal data privacy are notified to the PCPD at an early stage. In addition, the Legal Division of the PCPD reviews and, where appropriate, comments on all Bills published in the Government Gazette for their possible data privacy implications. Summaries of the PCPD's comments on some of the legislation proposed during the reporting period are provided in Appendix.

Review of the Personal Data (Privacy) Ordinance

Since 1998, the PCPD has been involved in discussions with relevant government departments and policy bureaux regarding possible amendments to the Ordinance. The amendment proposals made to date are deemed necessary to alleviate difficulties experienced in applying the requirements of the Ordinance and to enhance the overall effectiveness of data privacy protection in Hong Kong. During the reporting period, all amendment proposals have been reviewed. Based principally on needs and regulatory efficiency, the Privacy Commissioner felt that priority should be given to the following proposals.

Offence Investigation and Prosecution Power

The existing provisions of the Ordinance do not provide the Privacy Commissioner with the power to undertake investigations into suspected offences and, where appropriate, institute prosecution actions in relation to those offences. Investigation of criminal offences under the Ordinance is currently referred by the PCPD to the Hong Kong Police, subject to the consent of the complainant. After completion of an investigation by the Police, the case may then be referred to the Department of Justice who consider its merits and whether to proceed with a prosecution. The arrangement with the Hong Kong Police and the Department of Justice commenced in 1998 with an understanding that it was a temporary measure pending amendments to the Ordinance that would give the necessary powers to the Privacy Commissioner. It should be noted that there has been growing public demand for the Privacy Commissioner to exercise more stringent enforcement against intrusion upon personal data privacy. To respond to the demands of the community, it is desirable to expedite the legislative process with a view to conferring powers upon the Privacy Commissioner that would enable him to investigate and prosecute offences.

The 45-day Period to Refuse to Carry out or Continue an Investigation under s.39(3)

Under section 39(3), the Privacy Commissioner may decide not to proceed with the investigation of a complaint or to discontinue it. Where he elects to do this, he is required to give notification of refusal to the complainant within 45 days from the date of receipt of the complaint. In the past, the PCPD has experienced difficulties in complying with the 45-day period requirement. These difficulties arise either because of the time taken by the complainant to provide essential information or because the party complained against delays a response. From time to time, complainants have challenged the legality of the Privacy Commissioner's decision to refuse investigation after the 45-day period has elapsed . Until an authoritative view has been formed, it is expected that more legal proceedings on the matter will be instituted. It would therefore be beneficial to pass an amendment extending the current 45-day period so as to avoid unnecessary litigation in future.