Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance

as recorded in the Cause Books.

•

Bankruptcy information: the main purpose of the Official Receiver’s Office in

publishing the bankruptcy orders in the Gazette and maintaining a public register is

to inform the public that the named person was bankrupt and all related debts

should be paid to the trustee to settle the debts of the bankrupt. Furthermore, the

•

Annual returns of company: the main purpose for which the Companies Registry

makes available the company registration information is to enable members of the

public to authenticate, when dealing with a company, the identity of the person

holding himself as the director or other officer of the company. The terms and

conditions of the search services of the Companies Registry stipulate that users of

the services undertake not to sell the data and documentation provided by the

services in any form or make copies of the documentation from which products

may be derived for resale without the prior written consent of the Registrar of

Companies.

The Commissioner was of the view that the disclosure of the litigation, bankruptcy and

company directors’ data of the complainants through the app had exceeded their

reasonable expectation regarding how such information in the public domain would be

used. It was not consistent with or directly related to the purposes of collection, or the

purposes for which the data was originally made publicly available by the Judiciary, the

Official Receiver’s Office and the Companies Registry. Hence, the data user who

compiled the database for access by users of the app was found to have contravened

DPP3.

7.30

In AAB No.54/2014, the AAB affirmed the Commissioner’s decision that the appellant

had breached DPP3 by revealing the complainant’s name in three hyperlinks on the

appellant’s website connecting to three anonymised judgments in the Legal Reference

System of the Judiciary’s website. These judgments concerning the complainant’s

divorce proceedings handed down in open Court were originally made available by

the Judiciary on its website. In 2010 and 2012, the Judiciary replaced the original

judgments in the Legal Reference System with the parties’ names anonymised at the

complainant’s request. It transpired that when one subsequently entered the

complainant’s name in the “search people” box of a website called “Webb-site”, it

would still lead to a page showing the complainant’s information. The appellant’s

website is a database platform providing online access to information relating to the

directors of Hong Kong listed companies, members of public statutory and advisory

boards, licensees under the licensing regime of the Securities and Futures Commission,

etc. Particularly, there were three hyperlinks with the judgments’ titles (referring to the

names of the complainant and her former husband) on the page. By clicking on the

hyperlinks, one would be taken to the three anonymised judgments in the Legal

Reference System, thereby revealing the complainant’s identity.

7.31

In the above case, the AAB considered that in subsection (4) of DPP3, the phrase “the

purpose for which the data was to be used at the time of the collection of the data”

Details of the Commissioner’s findings can be found in the Investigation Report No. R13-9744, available on the Website: