Date: 27 December 2019
Response to media enquiry on disclosure of the Hong Kong Identity Card of a reporter
Thank you very much for your enquiry in relation to the reported disclosure of the Hong Kong Identity Card of a reporter. The office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) is aware of the media reports and the statement from the Hong Kong Journalist Association. There are justifiable grounds to initiate an investigation. The PCPD cannot comment on the case before the completion of the investigation. We now make preliminary observations in accordance with the relevant provisions of the Personal Data (Privacy) Ordinance (PDPO):
-
Generally speaking, when collecting personal data, any person (as a data user) must ensure the means of collection is lawful and fair.
-
When a data user uses personal data (including disclosure), if its purpose is inconsistent or not directly related to the purpose at the time of collection, he/she must first obtain the prescribed consent of the data subject, unless such use is exempt from the relevant provisions by virtue of the exemption under the PDPO.
-
Also, data users must adopt proper data security measures to ensure that personal data collected would not be accessed without authorisation or by accident.
-
Regarding the potentially inevitable disclosure of personal data of the reporter through live broadcast on the media concerned, the PCPD now states that if anyone obtains such personal data without the consent of the data user (such as in the public domain or platform) and discloses the personal data, and the disclosure causes psychological harm to the data subject, regardless of his or her intentions, that person may violate section 64 (2) of the PDPO. Upon conviction, the maximum penalty is a fine of HK$1,000,000 and an imprisonment for five years.