Mark Parsons, Eugene Low and Dominic Edmondson, Hogan Lovells
The Administrative Appeals Board rejected an appeal from David Webb against an enforcement notice issued by the Privacy Commissioner for Personal Data requiring that Mr. Webb remove from his website (webb-site.com) the names of parties set out in court judgments of matrimonial proceedings published on the Hong Kong Judiciary’s website over a decade earlier.
David Webb is a former investment banker turned activist who runs a website offering information on corporate and economic governance in Hong Kong, including the various roles that particular individuals play in the financial and public sectors.
The AAB confirmed that Mr. Webb had contravened Data Protection Principle 3 (“DPP3”) of the Personal Data (Privacy) Ordinance (Cap. 486) by continuing to publish hyperlinks on webb-site.com to three judgments handed down between 2000 and 2002 by the Court of Appeal, each of which had been subsequently redacted by the Judiciary to remove the names of the parties.
Determining the Relevant Purpose of Data Collection
DPP3 requires that personal data shall not (without consent of the data subject) be used except for the purpose at the time that the data was collected, or a directly related purpose.
The AAB held that DPP3 is directed against the misuse of personal data, regardless of whether the relevant personal data has been published elsewhere or was in the public domain.
The AAB considered that “the purpose for which the data was to be used at the time of the collection of the data” was to enable the Judiciary’s judgments to be utilised as “legal precedents on points of law, practice and procedure of the courts and of public interests” and not to identify the parties in the judgments. Mr. Webb’s purpose as a data user (held to be “reporting and publication for general use”) amounted to a new purpose inconsistent with that for which the personal data was collected, in contravention of DPP3.
Balance between Freedom of Expression and Personal Data Privacy
The AAB determined that the balance between freedom of expression and data privacy protection struck by the Commissioner in its enforcement notice was not unreasonable. The Commissioner made a distinction between reporting facts capable of contributing to a debate of general public interest and making tawdry descriptions about an individual’s private life.
The AAB also rejected Mr. Webb’s arguments that open justice would exempt him from any breach of DPP3 and that DPP3 was disproportionate and unconstitutional.
Public Data is Still Personal Data
The main lesson is that personal data obtained from the public domain is still subject to the protection under DPP3.
The position in Hong Kong should be contrasted with Singapore, where the Personal Data Protection Act does not require organisations to obtain the consent of the individual when collecting personal data that is publicly available.
But a Precedent Set for Matrimonial Case Reports Only?
One factor that appears to have led to the AAB’s conclusion is the change of judicial practice to anonymise names of parties to matrimonial proceedings.
It would be interesting to know whether the AAB might have reached the same conclusion if the change in legal practice had not occurred.
Public Interest: A Delicate Balance
Thirdly, public interest in disclosure is not a trump card, and the Commissioner will undertake a balancing exercise in each case between the right to privacy and the public interest.
Rather than establishing a blanket “right to be forgotten” (as some argued was the case with the ECJ’s decision in Google Spain), the AAB’s decision has been based squarely on DPP3, which concerns the original purpose for which personal data was collected. The AAB gave a narrow reading to that term. Given the specific context of this case, however, there may well be news disclosures in future that could force the Commissioner to make more challenging assessments as to where the balance lies between privacy and public interest.