Case Notes

(AAB Appeal No. 15 of 2019)

Request to erase personal data – territorial scope and jurisdiction of the Ordinance – no extra-territorial effect – definition of data user – section 2(1) – application of the Ordinance solely based on the control requirement – no independent right to be forgotten in Hong Kong

Coram:
Mr. Erik Ignatius SHUM Sze-man (Pre-siding Chairman)
Mr. TONG Yee-hang (Member)
Mr. Dennis WONG Chiu-lung (Member)

Date of Decision: 7 August 2020

The Complaint

On one occasion, the Police arrested a number of persons (including the Appellant) for an incident. The incident together with names and post-titles of the arrested persons were widely reported in news and articles. The Appellant’s name and his posts held in official bodies were published. The Appellant further noticed that when a search was conducted through the web search services provided by a multinational technology company (“the multinational company”) using his name as keywords, the results showed links to the said news, articles and online forums.

Subsequently, the Appellant requested the multinational company to delist the links from the search results, alleging that the contents were defamatory, false and not supported by sufficient evidence. However, the multinational company considered that the request was unfounded and decided not to take any action about the links; but encouraged him to resolve any disputes directly with the website owners and individuals who had posted the contents. Dissatisfied with the responses of the multinational company, the Appellant therefore lodged his complaint with the Commissioner.

The Commissioner’s Decision

Upon preliminary enquiry by the Commissioner, there was no prima facie evidence of any contravention of the requirements under the Ordinance. Hence, the Commissioner decided to terminate the investigation under section 39(2)(d) of the Ordinance and in accordance with paragraph 8(e) of his Complaint Handling Policy. In particular, the Commissioner took the view that:-

1. The local subsidiary of the multinational company did not exercise any control over the collection, holding, processing or use of personal data in or from Hong Kong regarding the web search services provided and hence did not satisfy the meaning of “data user” under the Ordinance. For the multinational company, it lied outside the territorial jurisdiction of the Ordinance.
2. There was a lack of evidence to prove that the contents of the links retrieved from the web search were inaccurate. The Appellant failed to discharge the burden of providing sufficient information to establish a prima facie case of contravention of the Ordinance.
3. The “right to be forgotten” did not exist under the Ordinance; and the alleged non-erasure or retention of the data posted through the aforesaid links could be reasonably justified. The information regarding the arrest of the Appellant published through the aforesaid links was for journalistic purposes and there was no unlawful interest in displaying the links.
4. The Appellant’s personal reputation was outside the ambit of the Commissioner’s office.

Dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB endorsed the Commissioner’s decision not to pursue the complaint any further. The reasons given by the AAB were as follows:-

1. The scope / territorial jurisdiction of the Ordinance only covered the persons who acted as data users having their operations “controlled” in or from Hong Kong. The AAB agreed with the Commissioner’s interpretation that the Ordinance did not have any extra-territorial effect.
2. The applicability of the Ordinance vis-à-vis data users was dependent upon the “control” requirement, which also accorded with the definition of a “data user” under section 2(1) of the Ordinance as the determining factor in interpreting the territorial scope of the Ordinance.
3. All operations of the multinational company in relation to the web search services were performed outside of Hong Kong. The operating system, servers, etc. were all located outside Hong Kong with no contemporaneous evidence suggesting that the multinational company exercised “control” within Hong Kong. Hence, the multinational company did not satisfy the definition of a “data user” under the Ordinance.

In this regard, the AAB affirmed the Commissioner’s decision and took the view that the lack of extra-territorial effect of the Ordinance was sufficient to dispose of the appeal. As obiter dicta, the AAB considered the Appellant’s allegation that the interrelation between Data Protection Principle 2 (on retention of personal data) and section 26 of the Ordinance (on erasure of personal data) could not be interpreted as conferring upon an independent right of “the right to be forgotten” under the Ordinance.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in November 2020)