Many people have a high expectation of what my office can deliver in terms of privacy protection because they equate privacy with personal data privacy, when in fact the latter is only a subset of the former.
Although my title is often abbreviated to "Privacy Commissioner", I am actually the Privacy Commissioner for Personal Data who regulates not all forms of privacy but only the privacy of individuals in relation to personal data.
Privacy is an all-embracing concept, which covers:
Article 17 of the International Covenant of Civil and Political Rights (ICCPR) (incorporated in article 14 of the Hong Kong Bill of Rights Ordinance) provides for a guarantee against arbitrary or unlawful interference with privacy. The ICCPR also imposes on the government an obligation to adopt legislative and other measures to give effect to this guarantee2. In this regard, a series of reports was issued by the Law Reform Commission of Hong Kong (HKLRC) recommending that legislations be introduced to better protect these privacy interests. So far, only the recommendations on personal data protection and regulation of covert surveillance by public enforcement authorities culminated in the introduction of dedicated legislations. In particular, the Personal Data (Privacy) Ordinance (the ‘Ordinance") came into effect in December 1996 and my office commenced operation since then.
Even if personal data is involved and the Ordinance is engaged, certain exemptions under the Ordinance may apply which prevent us from playing a meaningful role. Notably, personal data held by an individual and concerns only with the management of his personal, family or household affairs; or so held only for recreational purposes, is exempt for all data protection principles.3 Conceivably, this exemption may be invoked in many cases of stalking and cyber-bullying.
Further, the Ordinance was written to protect personal data and hence could easily be challenged when it is applied to other privacy aspects. For example, a media intrusion case4 was lodged with us in June 2011, involving the publication by two gossip magazines of photos of three TV artistes depicting their daily lives and intimate acts within their private residences over a period of three to four days, including one showing an artiste in an undressed state. The photos were taken surreptitiously by the magazines' reporters using systematic surveillance and telescopic lens photography. This was tantamount to unfair collection of personal data and we issued an enforcement notice to the magazines directing them to delete the photos from their data base and to establish privacy guidelines for compliance by their staff to prevent a recurrence of the incident. After some three years, the matter is still not yet fully settled. Although my determination was upheld by the Administrative Appeal Board, the magazines have successfully sought leave from the court for a judicial review.
Finally, the sanctioning power under the Ordinance is limited. In most cases, malpractices in the collection and use of personal data are contraventions which on their own are not offences. An offence arises only when the enforcement notice remedying the contravention is not complied with. This approach may not be adequate when it comes to sanctioning some serious privacy intrusions like stalking which many people would agree should be criminalized.
The government's policy on introducing legislations for other privacy areas5 was that the issues in question were highly contentious and involved a number of complicated legal concepts, and a consensus in the community had to be reached before deciding the way forward. Their view was that among the LRC reports on privacy, the report on "stalking" was less controversial and should be dealt with first. Hence a public consultation on stalking was conducted in 2011-12.
I support the introduction of an anti-stalking legislation to afford better protection to stalking victims.6 It is undertstood that many respondents of the public consultation also expressed the same view.
It is disappointing to note that the government has recently concluded that they would not pursue legislating against "stalking".7 They have found clearly very divergent views on the different approaches of enacting such legislation and none of the approaches seems to be supported by a majority view. While there seems to be little or no objection to criminalising stalking, an acceptable means has yet to be found to avoid unduly interfering with the freedoms of the press and expression.
In effect, this position would probably mean that the government would also withhold considering the introduction of legislations for other privacy areas for an indefinite period of time. Meanwhile, we will have to make do with exploiting the Ordinance to regulate all privacy intrusions and tolerate the grave shortcomings of this approach. Regrettably, the situation is expected to aggravate as a result of the combination of advances in technological capability and innovations in their applications 8.
1 This classification is based on the UK Information Commissioner's Office's Privacy Impact Assessment Handbook (version 2).
2The reports are (1) Reform of the Law Relating to the Protection of Personal Data, (2) Privacy: Regulating the Interception of Communications, (3) Stalking, (4) Civil Liability for Invasion of Privacy, (5) Privacy and Media Intrusion, and (6) Privacy: The Regulation of Covert Surveillance.
3 Exemption under section 52 of the Ordinance.
4 See investigation report at http://www.pcpd.org.hk/english/publications/files/R12_9159_e.pdf
5 See the Secretary for Constitutional and Mainland Affairs's reply to an oral question raised by Legislative Council member Ms Audrey Eu recorded on pages 1765-1766 in Legislative Council proceedings of 10 November 2010.
6 See our submission dated 31 March 2012 at http://www.pcpd.org.hk/english/files/infocentre/stalking.pdf
7 See Legislative Council Panel on Constitutional Affairs LC Paper No. CB(2)1758/13-14(05) at http://www.legco.gov.hk/yr13-14/english/panels/ca/papers/ca0616cb2-1758-5-e.pdf
8 See, for example, my earlier blog dated 29 April 2014 which highlighted the privacy risks brought about by the use of Google Glass and drones in private surveillance and stalking.