Case Notes

(AAB Appeal No. 8 of 2018)

Legislative Council member – marshalling duties in the public areas of the LegCo Complex – vital public interest for the Government in ensuring the passing of bills and motions (Article 62, Basic Law) – no excessive or unfair collection for passive recording of the whereabouts of the LegCo members (DPP1(1), DPP1(2)) – notification requirement applies to consensual collection (DPP1(3)) – openness and transparency of the relevant policies and practices communicated to all LegCo members (DPP5)

Coram:
Mr. Paul LAM Ting-kwok, S.C. (Presiding Chairman)
Mr. CHAN Kam-man (Member)
Ms. Christine YUNG Wai-chi (Member)

Date of Decision: 23 March 2020

The Complaint

The Appellant was a member of the Legislative Council of the HKSAR (“LegCo”). The Appellant noticed that the public officers would record the whereabouts of the LegCo members in the LegCo Complex (“Marshalling Duties”) so as to ensure the Government’s motions could be passed. The Appellant believed that the acts of the Government contravened the requirements of the Data Protection Principles (“DPPs”) under the Ordinance.

The Commissioner’s Decision

On 23 April 2018, the Commissioner decided not to investigate the Appellant’s complaint further under section 39(2)(d) of the Ordinance as there was no prima facie evidence indicating that the Marshalling Duties contravened any requirements of the DPPs for the following reasons:-

No breach of DPP1

• The Government was under a duty to procure the timely consideration of bills and motions by the LegCo and the purpose of the Marshalling Duties was to assist Government officials in monitoring the situation of the LegCo to discharge such duty. It was therefore a proper and lawful purpose.
• As public officers merely observed and recorded the names and the whereabouts of the LegCo members (which constituted respective “personal data” within the meaning of the Ordinance) in the public areas of the LegCo Complex, the collection was neither unfair nor excessive. Further, such collection by way of passive observation would not trigger the application of DPP1(3), which require the taking of specified steps in informing the data subjects (i.e. the LegCo members) concerned.

No breach of DPP2

• There was no information before the Commissioner that the Government had failed to delete the personal data collected.

No breach of DPP3

• There was no change of use of the personal data against the original collection purpose as the information concerning the whereabouts of the LegCo members (passed by the public officers to the relevant Government bureaux / departments) was, at all material time, for securing the necessary quorum of the meeting.

No breach of DPP4

• There was no evidence suggesting that the Government bureaux / departments had failed to follow their established guidelines on data security and IT requirements.

No breach of DPP5

• The Commissioner was satisfied that, by way of the press release issued by the Secretary for Justice in 2013 and the series of correspondences from the Administrative Wing to the Legislative Council Commission in 2017, the Government had already provided the relevant information to the LegCo members regarding the policies and practices of the Marshalling Duties.

No breach of DPP6

• There was no evidence suggesting the Appellant had lodged a data access request with any of the Government bureaux / departments. Even if such a request had been made by any of the LegCo member, the Commissioner reasonably believed that the personal data collected by the Marshalling Duties would be erased immediately thereafter.

Dissatisfied with the Commissioner’s decision, the Appellant lodged an appeal to the AAB.

The Appeal

The AAB dismissed the appeal and affirmed the Marshalling Duties to be compliant with the DPPs. In particular, the AAB opined that the updated information of the whereabouts of the LegCo members in the LegCo Complex would be important for the Government to discharge its constitutional duty under Article 62 of the Basic Law (“BL”) for matters transacted in the LegCo, which was a matter of important public interest. The gist of the decision is summarised below.

Applicability of the Ordinance

• The AAB opined that performance of Marshalling Duties by public officers involved collection of personal data of LegCo members and hence governed by the Ordinance. The information collected, which includes:- (i) the names of individual LegCo members; and (ii) whether they were in certain public areas of the LegCo Complex, constituted the meaning of “personal data” under section 2 of Ordinance.

Alleged contravention of DPP1(1)

• The AAB stressed that collection of the aforesaid personal data represented the “bare essential” information to ascertain the whereabouts of the LegCo members in the public areas within the LegCo Complex, which was not excessive. Further, the Marshalling Duties enabled the Government in:- (i) acquiring first-hand information about the progress of the meeting; (ii) monitoring the conduct of voting; and (iii) obtaining a better grasp of members’ attendance as a whole, which ultimately served the legitimate purpose of the Government with discharging its constitutional duty to ensure the passing of a bill or motion under Article 62, BL. The act of collection and the data collected was for a lawful purpose directly related to the function of the Government in vital public interest.

Alleged contravention of DPP1(2)

• The AAB reiterated that there is no requirement under the Ordinance requiring prior consent before collection of the personal data of the data subjects, i.e. the LegCo members. There was no suggestion, let alone evidence, that Marshalling Duties had been performed in restricted areas inside the LegCo Complex where the activities of individual LegCo members were meant to be kept confidential and not to be observed by others. The practice of passively recording the whereabouts of individual LegCo members in public areas with no sensitive personal information collected could not be unfair.

Alleged contravention of DPP1(3)

• The AAB also refused the Appellant’s allegation that he had received no notification regarding the purpose of use of the personal data collected, the class of transferees etc. on or before collection of their personal data under DPP1(3). The AAB took the view that the notification requirement did not apply where public officers passively collected the whereabouts of LegCo members in a “non-consensual” manner.

Alleged contravention of DPP2

• The AAB concluded that there was no information or evidence substantiating the allegation that the Government had failed to comply with DPP2 by failing to erase the data and/or retaining the data collected for longer than is necessary after fulfilment of the purpose. To the contrary, the Government confirmed that the data collected will be erased on a daily basis upon completion of Marshalling Duties for that particular day.

Alleged contravention of DPP5 (and DPP6)

• Regarding the Appellant’s allegation that he had not been informed by the Government of the policies and practices regarding Marshalling Duties and that this was in breach of the requirement of openness and transparency, the AAB took the view that the principle was not about any notification to the individuals concerned. Evidence indicated that the Administrative Wing had already provided detailed information on the Marshalling Duties on various occasions to LegCo members via the Legislative Council Commission prior to his complaint to the Commissioner.
• Besides, the AAB took the view that the Appellant could have conflated DPP5 and DPP6 (concerning data access requests). In any event, the AAB agreed with the Commissioner’s findings and concluded that the requested data (even assuming the Appellant had lodged a data access request) could have no longer existed owing to the daily erasure policy of the Government and hence it could not have been accessed.

The AAB’s Decision

The appeal was dismissed.

(Uploaded in July 2020)