Date: 11 July 2019
Privacy Commissioner’s Response to the Display of Police Officers’ Personal Data in Public Places
In response to the display of police officers’ personal data in public places, the Privacy Commissioner for Personal Data (Privacy Commissioner) made the following statement:
-
Any person disclosing (e.g. publicly displaying) others’ personal data, no matter whether the data was obtained from the public domain, must consider whether the means of collection and use is legal and fair. If personal data is collected and disclosed for the unlawful purposes of bullying, incitement and intimidation, it is certainly illegal and unfair, and it contravenes the Data Protection Principles (DPPs) or requirements of the Personal Data (Privacy) Ordinance (PDPO), as well as other relevant laws.
-
The Privacy Commissioner reiterated that everyone should respect other individuals’ personal data privacy. Bullying behaviour of this kind may incur civil and criminal liabilities.
-
For contravention of DPPs of the PDPO, the Privacy Commissioner may serve an enforcement notice to direct the data user to remedy the contravention. Contravention of an enforcement notice is an offence which could result in a maximum fine of HK$50,000 and imprisonment for 2 years.
-
If any person suspects that his personal data privacy has been infringed upon and can provide prima facie evidence, he may complain to the office of the Privacy Commissioner.
-
It should be noted that contravention of the PDPO may constitute a criminal offence. Under such circumstances, criminal investigations will be carried out by the Police and prosecution decisions will be made by the Department of Justice. Section 64 is one of the criminal offence provisions of the PDPO.
-
For the enforcement of the criminal law, it is entirely determined by the enforcement authority according to the legal procedures and evidence.
-
Under section 64(1) of the PDPO, a person commits an offence if he discloses any personal data of a data subject obtained from a data user without the data user’s consent with the intention-
-
to obtain gain in the form of money or other property, whether for his own benefit or that of another person; or
-
to cause loss in the form of money or other property to the data subject.
-
Under section 64(2) of the PDPO, a person will commit an offence if he discloses, irrespective of his intent, any personal data of a data subject obtained from a data user without the data user’s consent and the disclosure causes psychological harm to the data subject.
-
Contravention of section 64 of the PDPO may attract a maximum fine of HK$1,000,000 and imprisonment for 5 years.
-
What amounts to contravention of section 64 of the PDPO turns on all the relevant facts of each case and there is no generalisation. According to the legislative background and intent of the provision, the following are typical examples of the offence:
-
Sale by an employee of a company of customers’ personal data without the company’s consent, and for which he received payment from the purchaser.
-
Disclosure by a hospital staff of a celebrity’s health records, which he obtained without the hospital’s consent and the disclosure caused psychological harm to the celebrity.
-
Uploading of a celebrity’s intimate photos to the Internet by a staff of a laptop repair company, which he retrieved without authority from that celebrity’s laptop during repair, and causing psychological harm to the celebrity.
-
As at 5 pm today (11 July), no complaint about posting of police officers’ personal data on Lennon walls was received.
－End－