The Privacy Commissioner for Personal Data, Hong Kong (“Privacy Commissioner”), Mr Stephen Kai-yi WONG has responded to public concerns about disclosure of a reporter’s personal data. The following is the full text of the reply:
"I have received your communications on my earlier decision to initiate an investigation against the Police regarding a police officer handling a reporter’s Hong Kong Identity Card (“HKID card”) in front of the media’s live stream camera. I am most grateful for your views and comments, which fully demonstrated your care and concerns about Hong Kong and the Police, and your earnest expectations on me as the Privacy Commissioner, as well as the Privacy Commissioner’s office (“PCPD”).
Background
Like you, on 26 December 2019, I noted from TV live streaming that a face-masked person wearing black clothes demanded a reporter to furnish his identification document when the reporter was covering news on-site. It appeared from the live streaming that the face-masked person was holding the reporter’s HKID card in front of the camera for quite some time. Subsequently, this incident was widely reported by the media and I was requested by a number of media for urgent response by 9:30 pm on the very same day. On the following day, I was urged by the Hong Kong Journalists Association and the Hong Kong Press Photographers Association to “solemnly follow-up and investigate into the matter” in their joint statement 1.
In addition, I noted the Chief Superintendent Mr Kwok Ka-chuen of the Police Public Relations Branch admitted of his own volition during the press conference held on the following day (27 December 2019) that the face-masked person was a police officer who was stopping and searching the said reporter. The Police explained that at the material time, the police officer held up the reporter’s HKID card, which was filmed by the reporter’s camera thereby exposing his identity to the public at large. The Police said that “what this officer did was inappropriate” and that the Police would initiate an investigation into the matter and would facilitate the PCPD’s investigation when required 2.
Nobody is above the Law – Initiating an Investigation by the PCPD and the Facilitation by the Police
You may wish to be reminded that on 4 August 2015, the very first day when I took office, I already stated at a media interview that I would enforce the law impartially and dutifully in strict accordance with the powers and functions conferred upon me by the Personal Data (Privacy) Ordinance (“PDPO”) 3 . This approach is in line with the remarks made by Senior Superintendent (Operations) Mr Ng Lok-chun of the Police Hong Kong Island in his response to the arrests made during the procession on 1 January 2020 – “No one has any special privilege” 4.
After taking into account all the circumstances of the case in question (including media reports, relevant video clips and the content of the conversations recorded at the material time, as well as the requirements of the PDPO, etc.), I, as always, made timely responses to all media enquiries. I am sure you would understand that whether my response was reported in a “high-profile” manner or not was beyond my control.
Responsibility of Initiating Investigations
Section 38(b) of the PDPO gives me the power to initiate investigations in this case after taking into account the following factors:-
I therefore came to the conclusion that I had reasonable grounds to believe that the conduct of the police officer concerned might have contravened the Data Protection Principles under the PDPO:
It should be noted that since the establishment of the PCPD, the majority of the cases handled by my office fell within the category of contravening the Data Protection Principles of the PDPO. That said, my power to initiate investigations is not without limitations or restrictions (see below).
No Double Standards : Only Different Statutory Standards
Different legal standards under different legal provisions in the PDPO would apply to the facts and circumstances of each case. It is trite that the main objective of the Data Protection Principles of the PDPO is to protect individuals’ (the data subjects’) personal data by regulating any person or organisation which holds, controls or uses personal data (the data users). Therefore, it would be necessary in the first place to determine who the data user is and what he/she/it has done.
In this case, you seemed to have accused me of adopting double standards on the ground that I had not initiated investigation in earlier cases. The previous cases which were referred to me included the case of Mr Fu Guo Hao where photos containing his identification documents had been disclosed 5; the case of Lennon Walls where personal data of numerous individuals had been displayed 6; the image depicting a police officer’s warrant card and the case of suspected clandestine video-shooting of artistes inside a taxi 7. Pausing here, I must reiterate that the common features of all these previous cases are that the data users concerned were either the media engaged in news activities or unknown; and none of the data subjects concerned (i.e. Mr Fu Guo Hao, the victims of the Lennon Walls posts, the police officer concerned and the two artistes in the suspected clandestine video-shooting) lodged a complaint to me at the material time. I must also point out that conducting news activity may be exempted from liability under the PDPO even if there is a contravention of the relevant requirements 8. Given that there were no complaints lodged by the data subjects involved, the law said I had no power under section 38(b) of the PDPO to initiate any investigation against the media 9 involved even though the news reports contained photos or videos containing the data subject’s personal data.
In contrast, there is no dispute that the police officer in the current incident collected and used the reporter’s personal data during the execution of his duties. Although the reporter concerned did not complain to me immediately thereafter, the act of the data user (i.e. the police officer) could not possibly be regarded as a news activity as defined in the PDPO (even though live images were broadcast by the media concerned at the material time). In the circumstances, I had reasonable grounds to believe that the act of the police officer might be a contravention of a requirement under the PDPO and I was duty bound to carry out an investigation in relation to the relevant data user (i.e. the Police)10.
Whilst I cannot blame you for not understanding the relevant laws before I explain them, I hope you would no longer maintain your view by labelling me as “making a swoop” in enforcing the law, “supressing the Police selectively”, “taking a high profile”, “making a mountain out of a molehill” or even to say that I am “yellow-coloured deep inside my marrow”. Further, I would expect that you would recall my earlier “swift-footed initiative” to investigate Professor Benny Tai Yiu-ting’s “pseudo-referendum” 11 before the last Chief Executive election was held; the LegCo member Ted Hui’s “phone-snatching case” in the Legislative Council Complex 12 ;as well as the PCPD’s initiating online patrols for tracking cases involving doxxing posts containing the personal data of police officers and their family members including children.
Non-criminal and Criminal Doxxing
What has troubled me is that I am still queried why I did not prosecute those engaged in doxxing, and accused of enforcing the law selectively thereby “indulging the evildoers”. I am sure you would understand that personal data has been weaponized during the recent doxxing cases over the last few months. In the past, doxxing was mostly among friends for the purpose of venting their resentment. Those cases primarily involved misusing personal data under their control and hence contravention of the requirements of the Data Protection Principles. They were non-criminal doxxing cases. Generally, I would serve an Enforcement Notice or warning, as the case may be, to the wrongdoers. Only non-compliance with my instructions would amount to an offence. In contrast, the posts in recent doxxing cases also involved intimidation or incitement which may cause psychological harm to the victims. Hence, the doxxers may have committed the offence of criminal doxxing under section 64 of the PDPO 13 .
Despite the fact that most criminals in the cyber world would hide their identities, I do not have comprehensive criminal investigation and prosecution powers under the PDPO. What I am required by law to do is to refer the suspected criminal doxxing cases, i.e. those cases involving a potential contravention of the requirements of section 64 of the PDPO, to the Police Cyber Security and Technology Crime Bureau for further criminal investigation. The Department of Justice will then decide if prosecutions should be preferred where appropriate. As of now, I have referred over 1,400 cases of criminal doxxing to the Police, of which 40% relate to police officers and their families. I agree that this situation leaves much to be desired, and that is why I reflected it to the Government in June 2019, advocating that the law should be reformed so that the Privacy Commissioner will be vested with comprehensive criminal investigation and prosecution powers as appropriate.
Sparing no efforts in combatting online violence
I am sure we all share zero tolerance towards any kind of violence. However, my hands are tied as the PDPO does not empower me to combat street violence. That said, the PDPO does empower me with certain, albeit insufficient powers to help curb online violence. Even though my enforcement team has fewer than 30 members, we have left no stone unturned and have dutifully done what we could under the law over the last six months or so. To date, a total of 4,400 criminal doxxing cases have been handled, of which 36% involved police officers and their families. Among those doxxing web links having been removed upon intervention by my office, 70% of them involved police officers and their families (see Appendix). If you are still minded that I cannot effectively combat doxxing acts and that I dodge my responsibilities, I have nothing more useful to add than to urge you to have a look at the Appendix. I cannot however blame the media for not covering my work as comprehensive or as frequent as I liked, but I do blame myself for, as a result of scarce resources, not having been able to present my work to you personally on top of issuing press releases and uploading related work reports on the website of my office in a timely manner.
Impartial and Fair Enforcement of the Law
Since its inception, the PCPD has always been an independent statutory authority, not being part of the Government, regulating both public and private organisations under the PDPO. The Privacy Commissioner’s decisions cannot be interfered with by anybody or organisations. If any person find my enforcement decisions objectionable, he/she may wish to follow-up through the established mechanism. However, I would like to stress that in this particular incident, I only initiated an investigation according to the law, without determining who or what is right or wrong. The crux of the Rule of Law is that nobody is above the law and no one has any special privilege. I can assure you that my enforcement decisions were never based on the background, political or otherwise, or status of the wrongdoers or offenders, and I will continue to do so.
Finally, I would like to express my profound gratitude to you again for speaking up for the overall interests of Hong Kong. The Rule of Law is the bedrock and cornerstone of the success of Hong Kong. As a gatekeeper of the PDPO, I would steadfastly continue to uphold with you the cardinal principles of the Rule of Law and the privacy right of individuals in the discharge of my statutory duties.
As the year of the Rat approaches, may I wish you a peaceful and prosperous year ahead.
Stephen Kai-yi WONG
Privacy Commissioner for Personal Data, Hong Kong
12 January 2020"
Remarks:
1 https://www.hkja.org.hk/%e8%81%b2%e6%98%8e/%e8%a8%98%e5%8d%94%e5%8f
%8a%e6%94%9d%e8%a8%98%e5%8d%94%e5%bc%b7%e7%83%88%e8%ad%b4%e8%
b2%ac%e8%ad%a6%e5%93%a1%e5%88%bb%e6%84%8f%e5%9c%a8%e9%8f%a1%e9%
a0%ad%e5%89%8d%e5%b1%95%e7%a4%ba%e8%a8%98%e8%80%85/
2 https://www.news.gov.hk/eng/2019/12/20191227/20191227_173932_388.html?type=category&name=law_order
3 https://hk.news.yahoo.com/video/%E5%80%8B%E4%BA%BA%E8%B3%87%E6%96
%99%E7%A7%81%E9%9A%B1%E5%B0%88%E5%93%A1%E9%BB%83%E7%B9%B
C%E5%85%92%E5%B1%A5%E6%96%B0-032123764.html (Chinese only)
4 https://www.news.gov.hk/chi/2020/01/20200102/20200102_172751_592.html?type=category&name=law_order&tl=t (Chinese only)
5 The Privacy Commissioner received a media enquiry on 28 December 2019, which he replied on the same day, explaining in detail how the incident was processed and the relevant legal bases relied upon. (https://www.pcpd.org.hk/tc_chi/news_events/media_enquiry/enquiry_20191228.html) (Chinese only)
6 The Privacy Commissioner responded to 6 media enquiries in July 2019 in relation to the Lennon Wall, which can be found on the website of the PCPD. The Privacy Commissioner also issued a media statement responding to the display of police officers’ personal data in public places.
https://www.pcpd.org.hk/tc_chi/news_events/media_enquiry/enquiry_20190710.html (Chinese only)
https://www.pcpd.org.hk/tc_chi/news_events/media_enquiry/enquiry_20190712b.html (Chinese only)
7 The incident was unfolded by the media on 16 April 2019, the Privacy Commissioner received media enquiry and replied on the same day, explaining the relevant laws to the media and the public
(https://www.pcpd.org.hk/tc_chi/news_events/media_enquiry/enquiry_20190416.html;
https://www.pcpd.org.hk/tc_chi/news_events/media_enquiry/enquiry_20190417.html;
https://www.pcpd.org.hk/tc_chi/news_events/media_enquiry/enquiry_20190417b.html) (Chinese only)
11 The Privacy Commissioner issued the first media statement on 13 February 2017 pointing out certain personal data privacy issues including unfair collection of personal data and the security risk associated with the concerned website. The organisation concerned decided to shut down the online activities two days later. (http://ce2017.appledaily.com.hk/articles/1_19928791)
12 The incident happened on 24 April 2018, the Privacy Commissioner released a media statement and responded to media enquiries on the following day (25 April 2018). (https://www.pcpd.org.hk/tc_chi/news_events/media_statements/press_20180425.html) (Chinese only).
Appendix
Regarding doxxing and cyberbullying related cases, the PCPD has already taken follow-up actions as follows:
In the meantime, the Privacy Commissioner continues to carry out publicity and conduct public education through various channels to help tackling the root causes by nourishing the culture of respect and protect personal data: