Privacy Issues Arising from the South Asian Tsunami

The devastating tsunami that struck the South Asian region on 26th December 2004 resulted in massive loss of life, property and livelihood. Among the dead or missing were residents from Hong Kong who had been vacationing in the region. The HKSAR Government responded to the tragedy by establishing a special task force, chaired by the Chief Secretary for Administration, to steer and coordinate the efforts of relevant Government Bureaux and Departments to render necessary assistance to Hong Kong residents affected by the tsunami and their families. The aim was to facilitate the early return of residents and to locate those who were missing.

Publication of Personal Particulars of Missing Persons

In responding to the disaster the Government set up a web page, "Tsunami Help Info" to provide updated information about the tsunami and its aftermath. The personal particulars of Hong Kong residents reported as having lost contact with their families were posted on the web page. The publication of personal details gave rise to the concern that this might infringe the data privacy rights of missing persons even though, prior to the publication of personal particulars, consent had been obtained from the families concerned.

In relation to the disclosure of personal data, DPP3 provides that, except with the prescribed consent of the data subject, personal data shall not be used for a purpose other than the purposes for which the data were to be used at the time of collection, or a directly related purpose. In this instance the personal particulars of missing persons were originally collected from families for the purpose of tracing the location of those persons. The subsequent posting of the information on the web page was intended to facilitate search operations. Only essential information i.e. names, photos, brief descriptions and circumstances of the missing persons were disclosed. Given the events that ensued after the tsunami struck, the PCPD formed the opinion that the publication of the particulars was consistent with the requirements of DPP3. That is, the purpose of publication and the original collection purpose were the same.

Disclosure of Immigration Movement Records of Missing Persons

A related issue that came to light following the tsunami involved requests for immigration movement records for the purpose of filing insurance claims and probate applications. Given the exceptional nature of the circumstances, insurance companies were generally prepared to deal with claims without the need to obtain immigration movement records once satisfied, based on other available information, that the insured party had indeed left Hong Kong for a destination in the area affected by the tsunami and had not returned after the disaster occurred.

As for probate applications, family members of missing persons whose bodies were not recovered might apply to the court for leave to swear to the death of the person concerned. Immigration movement records could serve as documentation in support of such applications. Privacy concerns were subsequently expressed regarding the disclosure of any such movement records to the courts, family members of missing persons or insurance companies.

In respect of disclosure to the courts, the PCPD took the view that it would be consistent with the requirements of DPP3. In particular, disclosure of personal data pursuant to a court order would generally be regarded as directly related to the original collection purpose, namely compliance with mandatory legal requirements.

With regard to disclosure to family members, of movement records collected at control points in Hong Kong, the PCPD noted that specific purposes of use were stated in the Personal Information Collection Statement of the Immigration Department. Disclosure of such records for the purpose of assisting family members in making an application for an insurance claim or probate matters was neither a stated purpose nor a directly related purpose. Insofar as movement records collected from local authorities in the tsunami devastated areas were concerned, the PCPD were informed that such information was collected as part of the efforts made by the Government to locate the whereabouts of missing persons in response to requests for assistance or missing reports filed by family members. For those whose bodies were not recovered, it would be proper for the Government to inform family members as to whether the missing persons had in fact stayed in tsunami affected areas. The PCPD formed the view that such disclosure would be directly related to the original purpose of collection and therefore consistent with DPP3.

In respect of disclosure to insurance companies, a possible exemption that could be considered is the provisions under section 58(2). This allows for an exemption from DPP3 where the use of the data is for the purpose of prevention, preclusion or remedying of unlawful or seriously improper conduct, where the application of DPP3 would likely prejudice matters. In considering whether to disclose the movement records to insurance companies, the Immigration Department might consider whether it had reasonable grounds for believing that failure to disclose the records might prejudice the purpose of preventing dishonesty by persons intent upon filing a fraudulent claim. However, the Ordinance does not contain provisions that compel the disclosure of personal data. Hence, whether the exemption could be invoked was a matter to be decided by the Department given the facts and evidence to hand.