Review of the Ordinance

The Commissioner's internal Ordinance Review Working Group has been working closely with the Government on the proposed amendments to the Ordinance. During the reporting period, the Commissioner has made additional amendment proposals to the Government. Amongst the new proposals made, three of which are to strengthen the Commissioner's enforcement powers. They are discussed below.

To Confer Power on the Commissioner to Require Payment of Monetary Penalty
The recently enacted UK Criminal Justice and Immigration Act 2008 provides under section 144 for the amendment of the Data Protection Act to confer on the Information Commissioner a new power to require data controllers to pay monetary penalty. The power is to be exercised in case of a serious contravention of the data protection principles and the contravention is likely to cause substantial damage or distress. The amount of penalty determined by the Information Commissioner must not exceed the amount as prescribed by the Secretary of State. The Information Commissioner is required to issue guidance on how he is going to exercise this function.

A more direct means of regulating contravention of the data protection principles will be offered if an equivalent provision is added to the Ordinance. It will result in greater deterring effect. The power to impose monetary penalty will have to be exercised within a clearly defined statutory framework and the level of penalty must be within the range as prescribed by the Government from time to time.

To Confer Power on the Commissioner to Award Damages
Section 52 of the Australian Privacy Act empowers the Privacy Commissioner to determine after investigation a specified amount by way of compensation to the complainant for the loss and damage suffered by reason of the act complained against. The loss or damage includes injury to the complainant’s feelings or humiliation suffered.

In Hong Kong, at present, only the court can determine the loss and damage (which may include injury to feelings) suffered by the complainant by virtue of section 66 of the Ordinance if he or she brings a civil claim against the data user. Over the years, the Commissioner notices that the provision is rarely invoked and civil claim of this kind is uncommon. One possible reason is due to the lengthy and costly litigation process.

In the past, the Commissioner has encountered criticisms from some complainants that he lacks the power to award compensation after conclusion of our investigation. An equivalent provision modeling on section 52 of the Australian Privacy Act will provide a quick and effective mechanism to redress the situation.

To Confer Power on the Commissioner to Provide Legal Assistance
The Law Reform Commission in its report on "Civil Liability on Invasion on Privacy" published in December 2004 recommended that the Ordinance should be amended to enable the PCPD to provide legal assistance to persons who intend to institute proceedings under section 66 of the Ordinance.

The granting of legal assistance will be determined on whether the case raises a question of principle or whether it is unreasonable, having regard to the complexity of the case or the applicant's position in relation to the respondent or another person involved or any other matter, to expect the applicant to deal with the case unaided.

With legal assistance, an aggrieved individual who suffered damage by reason of a contravention of a data protection principle may not have to bear all the legal costs in a civil claim under section 66 of the Ordinance irrespective whether such individual is eligible to legal aid.

With the joint effort of the Government and the PCPD, it is expected that a public consultation exercise on review of the Ordinance will be carried out by mid 2009.