Information Centre

Date: 14 March 2007
Privacy Commissioner released investigation report against email service provider

The Privacy Commissioner for Personal Data (the Commissioner) Mr. Roderick B. Woo published today a report (the Report) on the result of an investigation of the alleged disclosure by an email service provider in Hong Kong of its account subscriber's personal data.

The investigation finds no contravention of the Personal Data (Privacy) Ordinance (the Ordinance) and yet gives rise to concern about the scope of application of the Ordinance.

"It became evident to me in the course of the investigation that certain provisions of the Ordinance should be clarified for better performance of the Commissioner's regulatory function.  A clearer interpretation and application of the Ordinance will enhance the overall effectiveness in the protection of personal data privacy.  To this end, my Office is proposing a legislative review of the Ordinance and hope that the Government will facilitate the legislation amendment process." Mr. Woo said.


In October 2005, local newspapers reported that a mainland journalist, Mr. X, was convicted by a PRC Court of the crime of providing State secrets to foreign entities.  A Hong Kong email service provider, Yahoo!Hong Kong Limited (YHKL), was alleged to have disclosed Mr. X's personal data to the PRC law enforcement authorities which eventually led to Mr. X's  arrest and conviction.

As email service providers collect and hold a massive amount of email account holders' personal data, this incident aroused public concern about the protection of email subscribers' personal data privacy, in particular where disclosure is made in compliance with a lawful order issued by a foreign authority under foreign law for purpose of investigation of a foreign crime.

Commissioner's action

On 21 October 2005, the Commissioner took the initiative to probe into the matter to determine whether there had been a breach of the Ordinance.  Subsequently, the Commissioner received a complaint lodged by an authorized representative of Mr. X alleging that YHKL had disclosed Mr.X's personal data to the PRC authorities without his consent.  The Commissioner decided to carry out an investigation pursuant to section 38 of the Ordinance on 9 May 2006.

The investigation
The focus of the investigation was to find out whether any personal data of Mr. X was disclosed by YHKL; if yes, whether the disclosure had contravened Data Protection Principle 3 of the Ordinance; and whether such disclosure could be exempted under section 58 of the Ordinance.

The course of investigation was difficult due to the lack of supporting evidence provided by the complainant, and the limited information or evidence that could be gathered.  As the act of collection, holding, processing and use of the personal data in relation to the business operation of Yahoo!China which was owned by YHKL apparently took  place in the PRC, legal advice was sought from two PRC law experts on the applicability of the PRC laws and from a local Senior Counsel on the scope of application of the Ordinance.

Findings of the investigation

Having considered all the circumstances of the case, the Commissioner concluded that there was insufficient evidence to prove that Mr. X's personal data were disclosed by YHKL to the PRC authorities.  Hence there had been no contravention of the requirements of the Ordinance by YHKL.

(For details of the legal grounds considered by the Commissioner, which involved mixed questions of facts and laws, please refer to the body of the Report.)

No enforcement notice was issued in consequence of the investigation.

Commissioner's comments arising from the investigation
The investigation of the case highlights the need to have more clear-cut answers to the following questions:

(a)    Should the Ordinance apply where none of act of collection, holding, processing and use of the personal data takes place in Hong Kong?

(b)    Should the Ordinance apply where the disclosure of personal data is made in compliance with a lawful order issued by a foreign authority under foreign law for the purpose of investigation of a foreign crime.

The Commissioner shall bring to the attention of the Home Affairs Bureau issues emanating from the Report for Government's due consideration.

Copies of the Report are available from the Commissioner’s Office at 12/F, 248 Queen's Road East, Wan Chai, Hong Kong.  They are also available for download from the website of the Commissioner's Office (



Back to top


End of Page

[Media Statement] [Speeches, Articles & Papers] [Exhibition Materials] [Other Related Websites] [Archive] [Other Resources] [On-line Self Training] [Submissions to Public Consultation] [Privacy Commissioner's response following former Deputy Commissioner's conviction] [Response to the loss of medical data by Department of Health] [Privacy Commissioner commits himself to securing patients' data] [Privacy Commissioner commences inspection against Hospital Authority] [Response to data leakage by Immigration Department] [Response to data loss by HSBC] [Privacy is Your Business International Privacy Video Competition] [Privacy Commissioner strives to promote protection of personal data privacy] [Response following former Deputy Commissioner's conviction] [The Privacy Commissioner's clarification on criminalizing data leakage] [The Privacy Commissioner responds to media report today that] [Response to data leakage by the Police] [Progress of Inspection Against Hospital Authority] [The Director of Immigration Department signed formal undertaking] [Speech by Privacy Commissioner at the special meeting of Legislative Council Panel on Home Affairs] [Response to data loss incidents by The Hongkong and Shanghai Banking Corporation Limited] [The Privacy Commissioner completes the Inspection of the Hospital Authority's Personal Data System] [Privacy Commissioner Publishes Inspection Report on Hospital Authority] [Privacy Commissioner explains recommendations on the protection of patients' data privacy] [Privacy Commissioner accepts an Undertaking by HSBC] [Privacy is Your Business International Privacy Video Competition Prize Presentation Ceremony] [Response to Judgment of judicial review application by Cathay Pacific] [Privacy Commissioner welcomes HA's effort to enhance patient data privacy] [Statement by the Privacy Commissioner Following the Judgment made in HCAL 50/2008] [PCPD received a letter from CX Flight Attendants Union] [Impact of Technology on Data Privacy] [Privacy Commissioner responds to taxi industry's proposal of installing CCTVs in taxis] [United Christian Hospital's loss of patients' data] [Privacy Commissioner hosts the 31st APPA Forum] [Privacy Commissioner urges job seekers to be careful when providing personal data] [Launch of a booklet on protection of personal data] [Investigation Report: Employer Collecting Employees' Fingerprint Data for Attendance Purpose] [The Recruitment of Deputy Privacy Commissioner (DPC)] [Response to Media Report on the Use of Fingerprint Recognition System by a School] [Privacy Commissioner Responds to Public Enquiries about the Issue of] [Investigation Report: Tutorial Centre Using a Student's Results Notice for Promotion without the Student's Consent] [Privacy Commissioner Welcomes Hospital Authority's New Measures on the Protection of Patients' Personal Data] [Investigation Report: Food Company Collecting Participants' Personal Data in Lucky Draw Activity] [Privacy Commissioner Responds to] [The need to ensure that individuals are identified by the correct personal identifiers: the case of identification of new born babies] [Public Consultation on Ordinance Review] [] [Response to Media Report on Searching for Others' Personal Data on the Internet] [Privacy Commissioner attended the 31st International Conference of Data Protection and Privacy Commissioners] [Response to Media Enquiries] [The "Value-for-money" Audit Report on PCPD issued by the Director of AuditThe] [Protective measures taken by the Hospital Authority which enhance the protection of new born babies and the accuracy of their personal data] [The Privacy Commissioner issued two investigation reports on data access request fee charged by data users and the proper handling of personal data transferred by data users to their debt collection agency] [A personal statement by Roderick Woo, the Privacy Commissioner] [Office of the Privacy Commissioner for Personal Data's Annual Report won international awards for three consecutive years] [Privacy Commissioner Launches Privacy Awareness Week 2010] [Response to recent discussion about third parties' requests for patients data] [Opinion Survey: Senior Citizens' Attitudes and Perceptions towards Personal Data Privacy] [Public Seminar on] [Privacy Campaign for Insurers] [Google collected Wi-Fi data] [Google collected Wi-Fi data in Hong Kong] [Google collected Wi-Fi data in Hong Kong] [Privacy Commissioner attended the 33rd Asia Pacific Privacy Authorities Forum] [Privacy Commissioner responds to a local magazine's editorial on privacy issues] [Privacy Commissioner Publishes Guidance Note on Data Breach Handling and the Giving of Breach Notifications] [Privacy Commissioner responds to an opinion survey report on Octopus cards and privacy issues] [Privacy Commissioner's Finding against HSBC was set aside by the Administrative Appeals Board] [The Personal Data (Privacy) Ordinance and Octopus Card System] [Privacy Commissioner initiates investigation on the Octopus] [Privacy Commissioner Publishes Information Leaflet on Privacy Impact Assessment] [Privacy Commissioner published new revised edition of a book to provide in-depth interpretation] [The Privacy Commissioner gives interim report on the investigation of Octopus] [The Privacy Commissioner Completed the Compliance Check on Google's Collection of Wi-Fi Payload Data] [The Privacy Commissioner has completed a Privacy Compliance Assessment Report on the Smart Identity Card System] [Collection of Visitors' Fingerprint Data by a Theme Park] [Investigation Report: Beauty Centre Transferring a Client's Personal Data to a Third Party without the Client's Consent] [Hong Kong Letter - Roderick Woo, Privacy Commissioner for Personal Data] [Mr. Allan Chiang took office as Privacy Commissioner] [A short video introducing the Personal Data (Privacy) Ordinance] [Privacy Commissioner reminds data users of the requirements of the Ordinance when engaging direct marketing activities] [PCPD joined APEC Cross-border Privacy Enforcement Arrangement] [Privacy Commissioner discussed organizations’ collection and use of personal data for direct marketing with a political commentary group] [Amended Data Access Request Form takes effect] [Response to media reports on the attendance records of the Personal Data (Privacy) Advisory Committee] [Privacy Commissioner completed investigation on Octopus Holdings Ltd] [Multi-media Information] [Investigation Report – Octopus Rewards Program] [Privacy Commissioner publishes Guidance on the Collection and Use of Personal Data in Direct Marketing] [Privacy Commissioner responds to Government's proposals on Review of the Personal Data (Privacy) Ordinance] [PCPD's Statement regarding investigations into the Octopus Group of Companies] [Hong Kong Letter - Allan Chiang, Privacy Commissioner for Personal Data] [Investigation Report: A Telecommunications Company Authorized Another Company to Conduct Telemarketing] [A Personal Statement by Mr. Allan CHIANG in response to media reports on his handling of a personal data privacy case when he was Postmaster General in 2005] [A Personal Statement by Mr. Allan CHIANG in response to media reports on his handling of personal data privacy cases when he was Postmaster General from 2003 to 2006] [Online Survey of the] [PCPD's Submission in response to Report on Public Consultation on Review of the Personal Data (Privacy) Ordinance] [The Sharing of Mortgage Data for Credit Assessment] [Public Forum on Proposed Revisions to the Code of Practice on Consumer Credit Data] [Privacy concerns about resumption of Google Street View car operation] [Public Consultation on the Sharing of Mortgage Data for Credit Assessment Ended] [Consumer Roadshow on Protection of Personal Data] [Consultation Report on the Sharing of Mortgage Data for Credit Assessment] [Amendments to Code of Practice on Consumer Credit Data To Take Effect]

[About PCPD] [The Ordinance] [PCPD Activities] [Information Centre] [Personal Data Privacy Liberal Studies] [Privacy Zone for Youngsters]
[Publications & Videos] [Enquiries & Complaints] [Case Notes] [Contact Us] [Search] [Site Directory] [Graphical Version]
[Chinese Version]

Notice/Copyright 2001 Office of the Privacy Commissioner for Personal Data, Hong Kong. All rights reserved. Disclaimer