|
Notes
on Appeal Cases Lodged with the Administrative Appeals Board
Under the Ordinance,
an appeal may be lodged by a complainant, or the relevant data user complained
of, against the decisions made by the Privacy Commissioner. Pursuant to
section 39(4), an appeal may be made by a complainant to the Administrative
Appeals Board ("the AAB") against the decision of the Privacy
Commissioner in refusing to exercise his powers to investigate or to continue
to investigate a complaint. An appeal may also be lodged by a complainant
pursuant to section 47(4) against the decision of the Privacy Commissioner
in refusing to issue an enforcement notice against the data user complained
of, after completion of an investigation. Similarly, a data user that
is the subject of an investigation has the right to appeal to the AAB
pursuant to section 50(7) against the decision made by the Privacy Commissioner
in issuing an enforcement notice against it.
A total of 15 AAB
appeal cases were heard during the reporting period. Case notes on selected
appeal cases are presented below.
[Image of image]
| [Image of image] |
|
Disclosure
by a Tribunal of an applicant's medical certificate to the respondent
in a court action -Personal Data (Privacy) Ordinance has no application
to judicial acts
(AAB
APPEAL NO.39/2004)
|
| [Image of image] |
|
The
Complaint
The complainant
complained against a Tribunal for unauthorized disclosure to the
respondent in a court action of his personal data contained in court
documents. The personal data in question being his medical certificate
submitted in support of his application for a review of the Tribunal's
decision. The complainant alleged that the Tribunal should not have
done so without his consent and complained to the Privacy Commissioner
for contravention of the Ordinance.
|
|
Findings
by the Privacy Commissioner
The Privacy
Commissioner conducted preliminary enquiry with the Tribunal. The
Tribunal admitted disclosure of the complainant's medical certificate
to the respondent for hearing the complainant's application for
a review of the Tribunal's decision. The Tribunal considered that
the medical certificate constituted court documents and that the
act of disclosure was part of the judicial process. It was the view
of the Tribunal that both court documents and judicial process were
not within the jurisdiction of the Ordinance.
The Privacy
Commissioner agreed that the disclosure by the Tribunal of the medical
certificate in the course of handling the complainant's application
was a judicial act which was not within the scope of the Ordinance.
The Privacy Commissioner was of the further view that even if the
Ordinance was applicable, the disclosure was consistent with the
requirement of DPP3 for being directly related to the original purpose
of collecting the complainant's personal data by the Tribunal, namely,
to handle his judicial application. As such, pursuant to section
39(2)(d), the Privacy Commissioner refused to carry out an investigation
of the complaint. Dissatisfied with the decision, the complainant
appealed to the AAB.
|
|
The
Appeal
The Board agreed
with the Privacy Commissioner's findings. The purpose of disclosing
the complainant's medical certificate was to ensure a fair trial
and that the respondent was entitled in the circumstances to know
the complainant's reasons to support his application for review.
The disclosure by the Tribunal to the respondent in a judicial application
was a judicial act which was not within the jurisdiction of the
Ordinance. The Board also agreed that, should the Ordinance have
application, the disclosure would have been consistent with DPP3
for being a purpose directly related to the original purpose of
data collection, namely to handle the complainant's court application.
|
|
The
AAB's decision
The appeal was
dismissed.
|
| [Image of image] |
|
Criminal
proceedings for prosecution of offences relating to living on the
earnings of prostitution - photographs downloaded from a memory
card of digital camera seized during the operation were disclosed
to co-defendants of the action by prosecution - photographs classified
as "unused materials" showed intimate acts and sex organ
of one of the complainants - common law on disclosure for fair trial
- directly related purpose and exemptions - DPP3 and section 58(1)(a)
and (b) and section 58(2)
(AAB
APPEAL NO.40/2004)
|
| [Image of image] |
|
The
Complaint
The complainants
jointly complained about the disclosure of certain photographs by
a law enforcement agency to the defendants charged with offences
relating to living on the earnings of prostitution. The photographs
were downloaded from a memory card of digital camera seized during
an operation. They showed intimate acts of the complainants and
the sex organ of one of the complainants. The complainants claimed
that such disclosure caused them embarrassment and infringed DPP3.
|
|
Findings
by the Privacy Commissioner
Upon enquiry
raised with the law enforcement agency, it was confirmed that the
photographs in question were downloaded and were categorized as
"unused materials", i.e. not being used as evidence to
support the prosecution's case. However, in accordance with the
common law duty on disclosure (the case of HKSAR v Lee Ming
Tee, FACC1/2003 was quoted as judicial authority on this
point), the prosecution has a duty to disclose these materials to
the defendants of the action. The prosecution also relied upon the
exemption provisions in section 58(2) of the Ordinance in relation
to personal data held for the prevention or detection of crime and
the apprehension, prosecution or detention of offenders as applicable
to exempt from compliance with DPP3 in respect of the use of the
personal data in question.
The Privacy
Commissioner found that compliance with the common law requirements
on disclosure of personal data was for a directly related purpose
and there was no evidence showing that the photographs were being
disclosed to unrelated parties. Moreover, it was found that section
58(1)(b) and (2) were properly invoked in the circumstances of the
case to exempt from application of DPP3. Pursuant to section 39(2)(d),
no investigation was commenced on the complaint lodged. Dissatisfied
with the decision, the complainant appealed to the AAB.
|
|
The
Appeal
The Board agreed
with the Privacy Commissioner's findings. The purpose of disclosing
the complainant's medical certificate was to ensure a fair trial
and that the respondent was entitled in the circumstances to know
the complainant's reasons to support his application for review.
The disclosure by the Tribunal to the respondent in a judicial application
was a judicial act which was not within the jurisdiction of the
Ordinance. The Board also agreed that, should the Ordinance have
application, the disclosure would have been consistent with DPP3
for being a purpose directly related to the original purpose of
data collection, namely to handle the complainant's court application.
The Privacy
Commissioner found that compliance with the common law requirements
on disclosure of personal data was for a directly related purpose
and there was no evidence showing that the photographs were being
disclosed to unrelated parties. Moreover, it was found that section
58(1)(b) and (2) were properly invoked in the circumstances of the
case to exempt from application of DPP3. Pursuant to section 39(2)(d),
no investigation was commenced on the complaint lodged. Dissatisfied
with the decision, the complainant appealed to the AAB.
|
|
The
Appeal
The question
to decide by the Board was whether the decision not to investigate
by the Privacy Commissioner was properly made. The Board examined
the common law duty of disclosure by prosecution as expounded in
Lee Ming Tee's case. The prosecution is under a common law duty
to disclose to the defence material or information in its possession
in the interest of a fair trial and the right to a fair trial includes
adequate knowledge of the case to be made by the prosecution. It
would be contrary to this common law principle if the prosecution
were to withhold from the defence materials which might undermine
the case against the defendant or which might assist the defence
case. Information not itself admissible might lead by a train of
inquiry to evidence which is admissible and materials which is not
admissable may be relevant and useful for cross examining of a prosecution
witness on credit.
In view of the
nature of the offence charged and having also considered that the
photographs were not disclosed to parties unrelated to the offence
charged, the Board found the disclosure to be for a purpose consistent
with the purpose of collection, i.e. for prosecution of the offence.
Besides, the Board also agreed that the exemption provisions under
section 58(1) and (2) applied to such disclosure of the personal
data.
|
|
The
AAB's decision
The appeal was
dismissed.
|
| [Image of image] |
|
Collection
of identity card numbers of visitors of car park for deterring and
detecting crimes - collection is only allowed when there is a real
need - retention of collected identity card numbers - clause 2.3
of the Code of Practice on the Identity Card Number and other Personal
Identifiers - DPP1(1) and 2(2)
(AAB
APPEAL NO.41/2004)
|
| [Image of image] |
|
The
Complaint
A driver lodged
a complaint against the management company ("the company")
of a car park in a commercial building for recording his identity
card number when he entered and exited the car park.
|
|
Findings
by the Privacy Commissioner
The company
claimed that there had been many theft incidents happened in the
car park and the commercial building, so they adopted the policy
for the purpose of prevention of crime and for assisting the police
in detecting crime. They also alleged that the practice was in compliance
with the guidelines issued by the police. Reliance was further made
by the company on clause 2.3.2.2 of the Code of Practice on the
Identity Card Number and other Personal Identifiers ("the Code")
which permits collection of identity card number for the purposes
listed under section 58(1) of the Ordinance (i.e. prevention or
detection of crime, apprehension, prosecution and detention of offenders,
etc.)
The Privacy
Commissioner took the view that clause 2.3.2.2 of the Code applied
only when there had been a real and practical need for the collection
but not for presumption of the possible commission of a crime in
the future. In relation to the guidelines issued by the police relied
upon by the company, the Commissioner found that it applied only
to visitors to a building but not to a car park. In the absence
of evidence that manifested the real need for collecting identity
card numbers, the company acted contrary to clause 2.3 of the Code,
and therefore was in breach of DPP1(1). As the identity card number
should not have been collected and retained, the company had breached
also DPP2(2) for unnecessarily retaining the number. An enforcement
notice was then issued to demand, amongst others, immediate cessation
of the collection of identity card numbers and destruction of all
collected numbers. Dissatisfied with the Commissioner's decision,
the company lodged an appeal to the AAB.
|
|
The
Appeal
The Board ruled
that while there were 5 incidents whereby the police required the
company to provide the CCTV recordings of vehicles entering and
leaving the car park, there was no evidence to support these recordings
related to the alleged theft incidents. In addition, the company
had not provided evidence to support the alleged numbers of theft
incidents happened in the car park and that the practice of collecting
identity card numbers had caused a drop of the number of crimes.
Moreover, the company never adopted a less privacy intrusive means
suggested by the police to deter crimes, i.e. using the two-card
system which required no collection of identity card numbers. As
far as the guidelines issued by the police was concerned, they were
merely directed to visiting building but not car parks that were
open to public. In any event, the guidelines were not legally binding
and its compliance did not necessarily satisfy the requirements
in the Ordinance.
The company
claimed that they retained the collected identity card numbers for
one month for the purpose of deterring and detecting crimes. Again,
there was no evidence to prove that such retention could assist
detecting criminals. In fact, according to the company, the police
never required the company to produce the retained identity card
numbers.
|
|
The
AAB's decision
Appeal dismissed.
[Image of image]
|
| [Image of image] |
|
Disclosure
of personal data by posting letter of complaint in lobby of a building
- failure to delete irrelevant data did not amount to breach of
DPP3 -collection unnecessarily meant active collection -cessation
of complained act before investigation - a more satisfactory result
could not be reasonably expected - discretion under section 39(2)(d)
- the Board would not intervene discretion exercised reasonably,
legally and in accordance with prescribed procedures
(AAB
APPEAL NO.47/2004)
|
| [Image of image] |
|
The
Complaint
The complainant,
who was the landlord of a residential property, sent a letter to
the Owners Incorporation of the building to complain against the
water seepage problem caused to her flat because of the improper
maintenance of common area. It was said in the letter that the Owners
Incorporation should bear the costs of repairing her flat. Upon
receiving the letter which contained the complainant's name, address
and telephone number, the Owners Incorporation posted the letter
in the lobby of the building. The complainant complained to the
PCPD that the Owners Incorporation failed to obliterate her data,
in particular her telephone number, from the letter before posting
it.
|
|
Findings
by the Privacy Commissioner
The Privacy
Commissioner came to the view that the purpose of posting the letter
was directly related to the purpose of collecting the complainant's
personal data hence, there was no breach of DPP3. Moreover, for
the letter had been taken down subsequently by the Owners Incorporation,
a more satisfactory result could not be reasonably expected from
any further investigation. The Commissioner therefore refused to
carry out an investigation pursuant to section 39(2)(d) of the Ordinance.
|
|
The
Appeal
The complainant
sought to argue amongst others, that:
| (i) |
the Owners
Incorporation had no ground to publicize her telephone number;
|
| (ii) |
DPP3 had
no application in the situation, for the Owners Incorporation
did not collect but was only given the letter containing her
personal data; and |
| (iii) |
The Commissioner
could not refuse investigation by stating that investigation
could not bring a more satisfactory result, for her privacy
had been intruded when the letter was posted in the lobby. |
The Board ruled
that the Owners Incorporation did collect the complainant's personal
data by passively receiving her letter of complaint, for the meaning
of "collection" did not necessarily mean active collection.
The purpose of posting the letter was to inform all owners of the
building, to give them opportunity to express opinion, and to make
decision in respect of the water seepage complaint. It was noted
that if the water seepage was as stated by the complainant, all
owners of the building would have to bear the repair cost. Accordingly,
the Board decided that the purpose of disclosure of the complaint
letter was directly related to the original purpose of collection
of the letter.
It was necessary
to disclose the content of the letter together with the complainant's
name and address. Otherwise, the owners would doubt the truthfulness
of the complaint, thus causing difficulties to the Owners Incorporation
in handling the problem. Although disclosure of telephone number
was of no assistance to the purpose of posting the letter, DPP3
was not breached.
In accordance
with section 39(2)(d), the Commissioner could base on whatever grounds
to refuse investigation, provided that he exercised his discretion
reasonably, legally and in accordance with prescribed procedures.
In this circumstance, the Board would not intervene his decision.
The Board agreed that in the circumstances of the appeal case, to
carry out an investigation of the complainant's complaint has no
practical effect since the purpose of requiring the Owners Incorporation
to take down the letter had been fulfilled. The Board therefore
decided that the Commissioner had reasonably exercised his discretion
to refuse to carry out an investigation.
|
|
The
AAB's decision
The appeal was
dismissed.
|
|