In response to the letter "Privacy plan takes an absurd turn"

In response to the letter "Privacy plan takes an absurd turn" published in The Standard on 27 February 2008, the Privacy Commissioner Roderick Woo explained the rationale behind his proposal to the government to consider creating a new offence that anyone obtaining, disclosing, leaking or selling personal data without the consent of the owner is committing an offence:

I am interested in Mr Peter Gordon’s article of 27 February 2008, “Privacy plan takes an absurd turn”.  Mr Gordon commented on my proposal to the Government to consider creating a new offence in order to deter irresponsible behaviour in handling personal data online.

First and foremost, I want to stress that my proposal is not intended to and should not interfere with the normal and innocuous browsing activities of web-users, nor will it interfere with the freedom of the press.

As I explained earlier in my two press statements (see http://www.pcpd.org.hk/english/infocentre/press.html), the rationale behind the proposal, apart from the deterrence of irresponsible handling of personal data online, is to curb (i) the unauthorized access and collection of customers’ personal data by a staff of a bank or a telecommunications company for the purpose of selling them to debt collection agents or third parties for profits; and (ii) the use of personal data for personal gains of the collector, such as the sale of the data to direct marketing companies or for perpetuating crime by theft of identity.  In any event, public views will be widely sought before my proposal goes any further.

Obviously Mr Gordon was also concerned about freedom of the press and he worried that “no sporting events could ever be published or broadcast because people in the stands could ‘be directly or indirectly identified’” and that, “newspapers or television news reports could not use the images of anyone at all without the subjects’ explicit permission.”  I wish to allay his fears.

May I explain that for data protection principles under the Personal Data (Privacy) Ordinance to engage, there must be, first of all, a collection of personal data.

To qualify for a “collection” :-
(a)       the collecting party must be thereby compiling information about an individual;

(b)      the individual must be one whom the collector of information has identified or intends or seeks to identify; and

(c)      the identity of the individual must be an important item of information to the collecting party.

Journalistic activities and particularly photo-journalism are not unduly inhibited by the Ordinance.  The Court of Appeal in the Eastweek Publisher Ltd (28 March 2000) case gave the following examples.  A business editor may consider it newsworthy to publish a crowd jostling in a queue for an initial public offering of shares in a company or for the purchase of flats in a new property development.  A features editor may likewise want a photograph of teenagers smoking cigarettes to illustrate a feature article on health concerns and a sports editor may want to print a picture of racegoers at Happy Valley to illustrate attendance in record numbers.  It is not unlikely that some of the persons identifiable in the photographs may not welcome the publication of their pictures.

The Court said that in none of the above cases is the publisher or editor in question seeking to collect personal data in relation to any of the persons shown in the photographs.  The fact that the photograph, when published, is capable of conveying the identity of its subject to a reader who happens to be acquainted with that person, does not make the act of taking the photograph an act of data collection if the photographer and his principals were acting without knowing or being at all interested in ascertaining the identity of the person being photographed.

A distinction is made where an individual’s photograph is taken with a view to its inclusion as part of a dossier being compiled about that individual as an identified subject, the act of photography would clearly be an act of personal data collection.  For example, the portfolio of photographs of particular actors, entertainers or fashion models maintained by a theatrical impresario or fashion modeling agency would clearly constitute personal data collected in relation to the individuals in question.  The point to note however is that there is nothing wrong in collecting such data so long as the provisions of the Ordinance are observed.

Mr Gordon may also find comfort in a news activity exemption under section 61 of the Ordinance.  The exemption applies to the use of personal data when they are disclosed to a data user who is engaged in news activity and such disclosure is made by a person who has reasonable grounds to believe (and reasonably believes) that the publishing or broadcasting of the data is in the public interest.

Mr Gordon also touched on the issue of copyright in the recent incident of data leakage, I would just make the point that the Ordinance is not directly concerned with copyright.  What it is concerned with is the data subject’s personal data privacy right.

Yours sincerely,

Roderick B Woo
Privacy Commissioner for Personal Data