Case Notes

(AAB Appeal No. 48 of 2015)

Name and post title being published by the media – no evidence that the information was leaked from the persons being complained against – exercise of investigative powers

Coram:
Mr Robert PANG Yiu-hung, SC (Deputy Chairman)
Mr Dick KWOK Ngok-chung (Member)
Ms Joan HO Yuk-wai (Member)

Date of Decision: 18 June 2024

The Complaint

The Appellant was a senior officer of a government department (the “Department”). He complained that his name and post title were published by the media in relation to an operation being conducted by the Police (“Police”) at his office at the Department to search and seize evidence. It was alleged that the Department and/or the Police had contravened DPPs 3 and 4 by failing to safeguard or leaking the personal data of the Appellant to the media.

The Privacy Commissioner’s Decision

Upon investigation, the Privacy Commissioner concluded that there was insufficient evidence of the alleged contravention. Dissatisfied with the decision, the Appellant appealed to the Board.

The Appeal

On appeal, the Board affirmed the Privacy Commissioner’s decision and dismissed the appeal on the following grounds:

1. The Privacy Commissioner has a wide discretion in the conduct of any investigation. Whether to utilize one or more of her investigative powers is a matter within her discretion. Whilst the Privacy Commissioner may consult a complainant if she thinks that it would be of assistance, there is no duty to do so.
2. Whether or not to summon a member of the press under section 44 of the PDPO to divulge the source of the information would be surrounded by a number of considerations which have to be balanced. The decision to exercise such power against journalistic materials should not be taken lightly since it would engage the rights of freedom of expression and the press. The Board did not consider that such power should be exercised in the circumstances of the case.
3. There was insufficient evidence to show that the information was leaked from the persons being complained against.
4. It is not a requirement under DPP4 of the PDPO for a data user to provide an absolute guarantee for security of personal data held by it as long as all reasonably practicable steps have been taken to ensure security of the personal data. There was insufficient evidence of contravention of DPP4 on the parts of both the Department and the Police.
5. In respect of the Appellant’s complaint on the Privacy Commissioner’s non-disclosure of the replies from the Department and/or the Police during the investigation process, the Board held that section 46(2) of the PDPO does not impose a statutory duty on the Privacy Commissioner to disclose every investigation finding to the Appellant.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in March 2025)