PAPER FOR PROVISIONAL LEGISLATIVE COUNCIL
INFORMATION POLICY PANEL
MEETING ON 26 SEPTEMBER 1997

INTRUSIVE REPORTING

INTRODUCTION

This paper provides information on the application of the Personal Data (Privacy) Ordinance ("the Ordinance" to intrusive reporting.

BACKGROUND

2. The Ordinance was drafted on the basis of recommendations of the Law Reform Commission ("LRC" in its report on reform of the law relating to the protection of personal data ("the report" published in August 1994. Following publication of the report, the LRC was due to continue its examination of privacy issues, including intrusion and interception of communications, and has been doing so. Accordingly, no attempt was made to cover such matters in detail in the Ordinance as this would have pre-empted the further work of the LRC. Nevertheless, the Ordinance, consistent with the relevant internationally recognised principles on the protection of personal data privacy, does have general provisions that seek to control the means employed to collect personal data and the use of personal data that are relevant to the issue of intrusive reporting. Specifically, Data Protection Principle 1 ("DPP1" in Schedule 1 to the Ordinance provides that, inter alia, personal data shall be collected by means that are "lawful and fair in the circumstances of the case" As regards the use of personal data, Data Protection Principle 3 ("DPP 3" provides that personal data may only be used, which includes disclosed and transferred, for the purposes for which the data were collected or directly related purposes unless the subject consents otherwise.

DATA PROTECTION PRINCIPLE 1

3. The term personal data is broadly defined in the Ordinance, such that media reports, and video footage and photographs of individuals from which it is practicable to identify the individuals concerned amount to personal data. Hence, the manner in which such data is collected by journalists should conform with the requirements of DPP 1.

(a) LAWFUL MEANS OF COLLECTION

4. The requirement in DPP 1 that collection of personal data be by lawful means includes lawful in both the criminal and civil senses. An example of a means of collection that is unlawful in the criminal sense would be theft of a document containing personal data. An example of a means of collection that is unlawful in the civil sense would be entering private premises without the occupier's permission or other lawful authority in order to photograph an individual.

(b) FAIR MEANS OF COLLECTION

5. The requirement in DPP1 that the collection of personal data be by means that are fair is clearly one that is open to a degree of interpretation. The PCO has advised that generally it would not be fair for a person collecting personal data to give misleading information about his or her identity or to adopt covert means of collection, e.g. using long range camera lenses or hidden cameras. Other examples of means of collection that are considered unfair in general are the taking of photographs of individuals in private premises from outside those premises without their consent, or taking photographs of individuals in public where those individuals have made it clear they do not wish to be photographed. However, the use of such means may nevertheless be fair "in the circumstances of the case" if there is some other over-riding public interest that is being served by the collection of the personal data concerned, such as the prevention or detection of crime. We note that this approach is consistent with the Hong Kong Journalists Association's own Code of Ethics (copy at the Annex), which requires that journalists shall obtain information by "straight forward means" subject to "over-riding considerations of the public interest" (item 5 of the Code of Ethics refers).

DATA PROTECTION PRINCIPLE 3

6. Under DPP 3, where data concerning an individual are collected by a data user for purposes other than for publication or broadcasting, such data may not subsequently be disclosed to the media for publication or broadcasting without his or her consent. However, section 61 provides for an exemption from this restriction where the personal data concerned are disclosed to a data user whose business consists solely or partly of a news activity and where the person making the disclosure reasonably believes that the publishing or broadcasting of the data is in the public interest.

7. The requirement under section 61 that the party disclosing the personal data to a journalist should reasonably believe that the publication or broadcasting of the data is in the public interest is also open to a degree of interpretation. Generally speaking, there appears to be a greater likelihood for a valid public interest justification to exist in relation to materials appearing in the news or editorial section of a newspaper or in a news or current affairs programme on television than otherwise. That said, however, whether the exemption is applicable in a particular case must necessarily depend on the actual facts of that case.

CONSEQUENCES OF A BREACH OF DPP1 OR DPP 3

8. The requirements of the data protection principles, including DPP 1 and DPP 3, are stated in general terms and are open to wide interpretation. Accordingly, it would be inappropriate for a contravention of them to result directly in criminal sanctions. The Ordinance does not therefore provide that a breach of a requirement of the data protection principles is an offence. The Ordinance does, however, give the Privacy Commissioner the power to enforce observance of the data protection principles by means of an enforcement notice. If, having conducted an investigation into a suspected breach of the Ordinance, the Privacy Commissioner is of the opinion that the relevant data user is contravening a requirement of the Ordinance, including a requirement of the data protection principles, or has contravened such a requirement in circumstances that makes it likely the contravention will continue or be repeated, he may serve an enforcement notice on the data user. Such an enforcement notice will direct the data user concerned to take such steps as are specified to remedy the contravention or matters occasioning it. Non-compliance with an enforcement notice is an offence rendering the data user concerned liable to fines and imprisonment.

9. Notwithstanding any action the Privacy Commissioner may take, an individual who suffers damage, including injury to feelings, as a result of a contravention of a requirement of the Ordinance, including a requirement of the data protection principles, has a right to compensation from the data user concerned. Such a claim would, however, need to be pursued by the individual concerned through the civil courts.

CONCLUSION

10. In summary, the protection against intrusive reporting provided by the Ordinance depends on general provisions in DPP 1, and subject to the exemption provisions of section 61, DPP 3 that can be enforced with criminal sanctions only in cases of a continuing or likely repeated breach following investigation by the Privacy Commissioner. On the other hand, the civil remedy provided by the Ordinance arises directly from a contravention of the relevant requirements of DPP 1 or DPP 3 that causes damage.

11. While the general provisions of DPP 1 provide some protection against the use of intrusive means to collect personal data, more protection would be provided by detailed statutory provisions with, where appropriate, direct criminal sanctions. This is what the Privacy Sub-committee of the LRC proposed in its consultation paper on regulating surveillance published last year. We look forward to the final recommendations of the LRC in its report on this subject, which we understand will be published by the end of this year.

Office of the Privacy Commissioner for Personal Data
September, 1997
Website : http://www.pco.org.hk