(AAB Appeal No. 54 of 2014)
The Appellant appealed against the Commissioner’s enforcement notice directing him to remove from his website three hyperlinks which disclosed the complainant’s identity in three anonymised judgments. The AAB upheld the Commissioner’s decision that the Appellant had contravened Data Protection Principle 3 of the Ordinance by publishing the hyperlinks on the Appellant’s website and determined that the enforcement notice was properly issued.
Coram :
Mr. Eugene Fung Ting-sek (Deputy Chairman)
Miss Hattie Cheng Kin-hei (Member)
Dr Cheung Chor-yung (Member)
The Complaint
The complainant was a member of several statutory panels. Three judgments were handed down in 2000, 2001 and 2002 concerning her divorce proceedings heard in open court, and these judgments, which originally contained the names of the complainant, her ex-husband and her children, were made available by the Judiciary in the Legal Reference System (“LRS”). However, in 2010 and 2012, the Judiciary replaced the three judgments in the LRS with their names anonymised at the request of the complainant.
In early 2013, the complainant found her name revealed on three hyperlinks on “Who’s Who” of a website operated by the Appellant, which were connected to the three anonymised judgments in the LRS. If a user entered the complainant’s name in the “search people” box of the Appellant’s website, the user would be brought to the “Who’s Who” page of the same website where information about the complainant would be shown. However, on this “Who’s Who” page, the three hyperlinks were embedded under the item “Articles”, and by clicking on “Articles”, the three hyperlinks with the judgments’ titles (referring to the names of the complainant and her former husband) would appear. This search process effectively identified the complainant by name in those three judgments, despite the anonymisation in them.
In March 2013, the complainant wrote to the Appellant for deletion of the hyperlinks but her request was declined. She then lodged a complaint with the Commissioner against the Appellant in disclosing her personal data on the said website.
The Commissioner’s Decision
Upon completion of the investigation of the complaint, the Commissioner concluded that the Appellant had contravened the requirement of DPP 3. In August 2014, the Commissioner served on the Appellant the result of investigation and an enforcement notice directing him to remove the three hyperlinks from the website and to confirm his compliance in writing together with supporting evidence.
Dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.
The Appeal
(1) Ground One
The Appellant argued that the “purpose” in DPP 3 refers to the purpose of the data collector. As the Appellant regarded himself as the “data collector”, his purpose of collecting personal data from the three judgments included publication of the data on his website. This purpose did not change at any time. The Appellant cited AAB No.36/2007 in support of this ground.
The AAB considered that in subsection (4) of DPP 3, the phrase “the purpose for which the data was to be used at the time of the collection of the data” referred to the purpose for which the data was originally collected. In this case, such original purpose referred to the purpose of the Judiciary being the person who first collected the relevant data.
The AAB did not agree that the Appellant’s purpose of using the complainant’s personal data (i.e. reporting and publication for general use) could be said to be consistent with the Judiciary purpose of publishing the judgments (i.e. to enable their judgments to be utilised as “legal precedents on points of laws, practice and procedure of the courts and of public interests”). There was nothing to suggest that the Appellant’s purpose was in any way related to the law. As the Appellant used the relevant personal data for a “new purpose”, the Commissioner was correct in concluding that the Appellant had contravened DPP 3.(2) Ground Two
Relying on paragraphs 30 and 32 of the Court of Appeal’s Judgment in TCWF v LKKS (CACV 154 & 166/2012), the Appellant contended that unless the court granted a specific injunction, it would not be against the law to publish the name of the parties in an action if their identities were known.
The AAB noted that there was no reference to the Ordinance or DPP 3 in TCWF v LKKS, which suggested that there was no issue of personal data protection and that the Court of Appeal was not concerned with the application of any provisions of the Ordinance in that case. The AAB did not consider the relevant paragraphs in the judgment as providing any defence or exemption to a contravention of DPP 3.
(3) Ground Three
The Appellant argued that if DPP 3 restricted the repeated use of public domain personal data, such restriction would be unconstitutional, because it violated Article 27 of the Basic Law and Article 16(2) of the Hong Kong Bill of Rights (i.e. freedom of the press and expression).
The AAB believed that the Commissioner had carried out the exercise of balancing the freedom of press and expression against the personal data privacy of the complainant. The AAB was of the view that the Commissioner’s conclusion, after performing the relevant balancing exercise, of tipping in favour of protecting the personal data of the complainant in the three anoymised judgments was not unreasonable.
(4) Ground Four
The Appellant submitted that the Commissioner had erroneously interpreted the term “data user” to embrace persons who merely read or collected and aggregated personal information in and from the public domain.
Noting what the majority of the Court of Appeal held in Eastweek Publisher Ltd v Privacy Commissioner for Personal Data [2000] 2 HKLRD 83, the AAB agreed with the Commissioner that in order to amount to collection of personal data within the meaning of the Ordinance, the collecting party must be compiling information about an individual, and that a person who merely read or collected and aggregated personal information in and from the public domain was prima facie not considered as compiling information about another individual, and the provisions of the Ordinance did not come into play.
Further, the AAB held that DPP 3 was directed against misuse of personal data regardless of whether the relevant personal data had been published elsewhere or was in the public domain, following the Court of Appeal decision in Re Hui Kee Chun (CACV 4/2012) in support.
The AAB’s Decision
The appeal was dismissed.
(Uploaded in August 2017)