One Step Closer To A Right To Be Forgotten In Hong Kong?

16 November, 2015

 

In our earlier article (please click here) on an appeal brought by David Webb against an enforcement notice issued by the Privacy Commissioner for Personal Data (the "Commissioner") requiring that Mr. Webb remove from webb-site.com the names of parties set out in court judgments of matrimonial proceedings published on the Hong Kong judiciary's website over a decade earlier, we considered to what extent individuals in Hong Kong might have a "right to be forgotten". The Administrative Appeals Board ("AAB") has now made a decision rejecting Mr. Webb's appeal.

The Decision

The AAB published its decision (please click here) with reasons on 27 October 2015, confirming that Mr. Webb had contravened Data Protection Principle 3 ("DPP3") of the Personal Data (Privacy) Ordinance ("PDPO") by continuing to publish three hyperlinks on webb-site.com to three judgments handed down between 2000 and 2002 by the Court of Appeal, which judgments were redacted by the Judiciary to remove the names of the parties and their children in 2010 and 2012 pursuant to a request by one of the parties. The judgments could still be located by using the complainant's name as a search term within webb-site.com, however, thus revealing her identity.

Determining the relevant purpose of data collection

DPP3 requires that personal data shall not (without consent of the data subject) be used except for the purpose at the time that the data was collected, or a directly related purpose.

The AAB held that DPP3 is directed against the misuse of personal data, regardless of whether the relevant personal data has been published elsewhere or was in the public domain. Mr. Webb was considered to be a "data user" (similar to the concept of "data controller" under EU law). The AAB considered that “the purpose for which the data was to be used at the time of the collection of the data” was to enable the Judiciary's judgments to be utilized as “legal precedents on points of law, practice and procedure of the courts and of public interests” and not to identify the parties in the judgments. Mr. Webb's purpose (held to be "reporting and publication for general use") amounted to a new purpose inconsistent with that for which the personal data was collected, in contravention of DPP3.

Balance between freedom of expression and personal data privacy

The AAB determined that the balance between freedom of expression and personal data privacy protection struck by the Commissioner in its enforcement notice was not unreasonable. The Commissioner had stated that "public interest must involve a matter of legitimate public concern. There is a distinction to be drawn between reporting facts capable of contributing to a debate of general public interest and making tawdry descriptions about an individual's private life. "

The AAB endorsed the Commissioner's view that "[i]n weighing the freedom of press and expression against the personal data privacy of the Complainant, … the disclosure of the Complainant’s identity in the three anonymized matrimonial judgments did not serve to promote the transparency of operations of companies, governments, regulators and controlling shareholders", nor was it able to achieve the purpose of "opposing public vices or protecting minority interests". In the circumstances, the balance should be tipped in favour of protecting the Complainant’s personal data.

Constitutional necessity

The AAB dismissed Mr. Webb's contentions based on Article 27 of the Basic Law and the Hong Kong Bill of Rights that any "restriction on a constitutional freedom" must be "necessary to protect another right" and must pass a "proportionality test" i.e. it must substantially achieve its goal and do no more harm to the freedom than is necessary. Mr. Webb argued that the test had not been passed because internet users outside of Hong Kong or using virtual private networks would be able to access the redacted data anyway and the Commissioner has no control over media entities publishing information outside of Hong Kong, meaning that local publishers would be placed at a competitive disadvantage disproportionate to any benefit from the restriction imposed by DPP3. That, the AAB held, was "not sufficient to render DPP3 unconstitutional" and upheld the balancing exercise carried out by the Commissioner.

Relevance of the principle of open justice

The AAB also rejected Mr. Webb’s argument that the common law principle of open justice under sections 51A and 60B(a) of the PDPO would exempt him from any breach of DPP3 , as Mr. Webb was not a judicial officer and was not required by any principle of law to publish the personal data of the complainant on webb-site.com. The AAB further found that the exemptions in sections 51A and 60B(a) do not attach to the personal data themselves but to the particular data user in question. Moreover, the public interest had already been taken into account by the Commissioner.

The AAB thus seemed to follow similar reasoning as it employed in the Do No Evil case, wherein the data user in question compiled personal data that remained in the public domain from three separate sources and was held to have contravened DPP3 by publishing them for a new purpose incompatible with each of the original collection purposes of the sources.

Comment

Public Data is Still Personal Data

The first take away point is, per the comments of Ms Fanny Wong, Acting Privacy Commissioner for Personal Data, in a statement dated 29 October, "[i]t is a misconception that publicly accessible personal data can be further used or disclosed for any purpose whatsoever without any regulation. Personal data obtained from the public domain is still subject to the protection under DPP 3."

She added that it is "not the [Commissioner’s] stance to ask for removal of articles from the archives of newspapers and publishers", noting that Mr. Webb was directed only to remove the hyperlinks showing the parties' names and that the anonymisation of the judgments was consistent with Article 10 of the Hong Kong Bill of Rights (which has binding effect on government and public authorities in Hong Kong) and with a direction of the Chief Justice, having effect from April 2011, that all judgments in family and matrimonial cases at every level should be anonymised before release.

Mr. Webb responded on webb-site.com on 30 October 2015 that "[t]he Decision, while it stands, will have a chilling effect on the freedom of the media in Hong Kong… [It] establishes an ECJ-style "Right to be forgotten" and removes a "Right to remember and repeat" without any proper legislation. In our submission, the … PDPO… was intended to keep private data private, not to make public data private."

Mr. Webb contended that the decision means that if the media reports the contents of court judgments relating to living humans and without their consent, then such "reporting and publication for general use" will be in breach of DPP3: "[w]e see no distinction in principle between linking to a judgment (a short form of report) versus repeating its contents in an article (as we sometimes do), with or without links to the judgments."

The position in Hong Kong should be contrasted with the position in Singapore, where the Personal Data Protection Act ("PDPA") does not require organisations to obtain the consent of the individual when collecting personal data that is publicly available. The Personal Data Protection Commission of Singapore states, in its Advisory Guidelines on Key Concepts in the PDPA, that "so long as the personal data in question was publicly available at the point of collection, organisations will be able to use and disclose personal data without consent under the corresponding exceptions, notwithstanding that the personal data may no longer be publicly available at the point in time when it is used or disclosed." Mr. Webb says that he may consider lobbying for a Singapore-style legislative amendment to explicitly exempt legally-published public domain data from the PDPO.

But a Precedent Set for Matrimonial Case Reports Only?

The second point to note is that Mr. Webb's purpose was held to be a new purpose over and above the purpose the Judiciary's web site had for publishing the information.

One factor that appears to have led to the AAB's conclusion is the change of legal practice in Hong Kong regarding the anonymisation of names of parties to matrimonial proceedings. It would be interesting to know whether, if the change in legal practice had not occurred and the parties names continued to appear in the judgments but the complainant had brought the request for removal of the links on the basis that webb-site.com's purpose of publication of her name was incompatible with the judiciary's purpose, the AAB might have reached the same conclusion.

Public Interest: A Delicate Balance

Thirdly, public interest in disclosure is not a trump card, and the Commissioner will undertake a balancing exercise in each case between the right to privacy and the public interest.

Rather than establishing a blanket "right to be forgotten" (as some argued was the case with the ECJ's decision in Google Spain), then, the AAB's decision has been based squarely on DPP3, which concerns the original purpose for which personal data was collected. The AAB gave a narrow reading to that term. Certainly the Commissioner has sought to give itself room for manoeuvre in future cases. Given the specific context of this case, however, which involved the anonymisation of matrimonial judgments, there is room for future decisions to distinguish it. There may well be news disclosures based on different facts that could force the Commissioner to make more challenging assessments as to where the balance lies between privacy and public interest.