Skip to content

Response to Media Enquiry or Report

Response to Media Enquiry or Report

Date: 6 March 2017

Privacy Commissioner Responses to Media Enquiry on Application of Data Privacy Rules to the Companies Register

Thank you very much for your email enquiry regarding application of data privacy rules to the Companies Register. Our responses are as follows:
 
  1. Public registers (including the Companies Register) contain personal data, such as names, residential addresses, Hong Kong Identity Card numbers etc., which can be made available for public access. Personal data in public registers are subject to the protection under the Personal Data (Privacy) Ordinance (“Ordinance”). In particular, personal data should only be used[1] for the purposes for which it was collected or a directly related purpose, unless the explicit and voluntary consent of the data subject is obtained or such usage is exempted. In other words, the personal data collected from a public register can normally be used only for purposes in line with or directly related to the purpose of setting up the public register.
     
  2. The Companies Registry’s arrangement (“arrangement”) for the public to indicate the purpose of conducting electronic company searches via its electronic search services was in accordance with the Guidelines issued by the government in year 2000 for protecting personal data contained in public registers operated by the Government bureaux and departments. Those purposes of conducting company searches as provided in the statement are specified with reference to the provision in section 45 of the Companies Ordinance.
     
  3. While we are not in the position to comment on behalf of the Companies Registry on whether it will introduce a new box for reporters, according to its statement[2] in response to media enquiries concerning the arrangement issued on 3 May 2016, the Companies Registry specially mentioned the scope of the seventh option can cover the collection of information for the purpose of news reporting activities.
     
  4. Hong Kong is known for the free flow of information and adequate protection of personal data privacy. The Ordinance does not censor any information content, but provides the legislative framework for the protection of personal data in terms of collection, use and transfer. We believe that the introduction of the arrangement can ensure all persons accessing or requesting access to conduct electronic company searches are aware of the specified purposes of the Companies Register and the need to confine the subsequent usage of the data collected from the Companies Register to such purposes.  The principle of proportionality is the key to strike balance between privacy rights and republication of information as well as other rights:
    1. Personal data obtained from the public domains (e.g. public registers) is still subject to the protection of the Ordinance (as stated in point 1). 
    2. The Ordinance provides exemptions for practical needs and in various circumstances, in particular:
  • Section 61[3] of the Ordinance relates to striking a fair balance between upholding the freedom of the press essential to journalists and the protection of the personal data privacy rights of individuals. If personal data is held solely for the purpose of news activity by a data user whose business consists of news activity: and the data user reasonably believes that the publishing of the personal data is in the public interest, then such disclosure may be exempt from the restrictions on use.
  • Under section 62[4] of the Ordinance, personal data that is used solely to prepare statistics or carry out research is exempt from the restrictions on use, if the resulting statistics or research is not made available in a form which identifies the data subjects.
 
 
More detailed explanations on how the data use principle under the Ordinance governs the use of personal data in the public domain can be found in the Privacy Commissioner’s “Guidance on the Use of Personal Data Obtained from the Public Domain”.
 

The information can be attributed to the Privacy Commissioner for Personal Data, Mr Stephen Kai-yi Wong.

[1]  Data Protection Principle 3 (“DPP3”) - Data Use Principle: Personal data must be used for the purpose for which the data is collected or for a directly related purpose, unless voluntary and explicit consent with a new purpose is obtained from the data subject.
[3] Section 61 (News) of the Ordinance applies to personal data held by a data user who engages in news activity for the sole purpose of that activity and primarily seeks to protect the source of information and to limit the right of access to such information. Section 61(2) comes in to exempt the source of information from the provisions of DPP3 if the following two criteria set out therein are satisfied, viz:
  1. the use of the data consists of disclosing the data to a data user referred to in subsection (1); and
  2. such disclosure is made by a person who has reasonable grounds to believe (and reasonably believes) that the publishing or broadcasting (wherever and by whatever means) of the data (and whether or not it is published or broadcast) is in the public interest.
[4] Section 62 (Statistics and research) of the Ordinance provides that “Personal data are exempt from the provisions DPP3 where-
(a) the data are to be used for preparing statistics or carrying out research;
(b) the data are to be used for preparing statistics or carrying out research;
(c) the resulting statistics or results of the research are not made available in a form which identifies the data subjects or any of them.”