Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

116 / 192

automatically hide the data. It also adjusted the height and angle of the computer
screens to make them less visible to bystanders. Notwithstanding the taking of these
measures, the Commissioner was not satisfied that they could effectively prevent the
unauthorised or accidental access to the personal data shown on the screen. An
enforcement notice was served on the company directing it to remodel the design of its
computer terminals so that the personal data displayed on the computer screens could
not be viewed by passers-by.13
(d) Legal Practitioners
8.21 Personal data handled by solicitors is very often sensitive, for example, personal data
used for litigation purposes, property transactions and matrimonial matters. Whilst
solicitors are already bound by a duty to keep all information concerning their clients
confidential, they should also take extra care and precaution to prevent any personal
data used for the provision of legal services from being accessed by unauthorised
persons.
8.22 In one case,14 a law firm arranged a messenger to serve legal documents relating to a
divorce suit on a party to the proceedings at her office. The documents were placed
inside a sealed envelope but there was a duplicate of the documents for the addressee
to sign and acknowledge receipt. Since the duplicate documents were uncovered, the
contents were read by the receptionist and other people passing by. The addressee of
the documents was upset as her involvement in the divorce proceedings was as a result
disclosed to others in the office. Upon enquiry made by the Commissioner, the law firm
argued that only the front page of the duplicate documents containing the names of
the parties and the suit number of the divorce proceedings were disclosed. The
Commissioner observed that these documents contained personal data of a sensitive
nature to the data subject, particularly in her workplace. The way that these documents
were served made it possible for such personal data to be disclosed to unnecessary
parties and caused distress to the complainant. The law firm was found to have
contravened DPP4.
8.23 A similar situation relating to the service of legal documents was also considered by the
Commissioner.15 In this case, the complainant specified a business centre’s address as
her correspondence address. A messenger of a law firm delivered a letter to the
complainant at the business centre’s address by hand. The receptionist called the
complainant and read out part of the contents of the letter over the telephone to the
complainant. The complainant complained to the Commissioner that the letter
containing her personal data, including reference to Court actions involving the
complainant, was unnecessarily disclosed by the law firm to the receptionist and the
13 See Case Note No. 2009C09, available on the Website:
ture=&msg_id2=336
14 See Case Note No. 1997C18, available on the Website:
ture=&msg_id2=112
15 See Case Note No. 2009A03, available on the Website:
ture=&msg_id2=321