Reform of the Law Relating to the Protection of Personal Data
Total Page:16
File Type:pdf, Size:1020Kb
THE LAW REFORM COMMISSION OF HONG KONG REPORT REFORM OF THE LAW RELATING TO THE PROTECTION OF PERSONAL DATA (TOPIC 27) August 1994 THE LAW REFORM COMMISSION OF HONG KONG REPORT REFORM OF THE LAW RELATING TO THE PROTECTION OF PERSONAL DATA ___________________________________ CONTENTS Chapter Page Introduction 1 1 The information boom 8 2 Information privacy in the international context 14 3 Hong Kong legislation and personal data privacy 28 4 Common law principles protecting privacy 44 5 The protection of personal data in Hong Kong - the need 61 for reform 6 The standards to be applied 73 7 Data protection laws in other jurisdictions 79 8 The objectives and scope of a data protection law 83 9 Collection of personal data 96 10 Regulation of the use and disclosure of personal data 113 11 PIN's and data matching 129 12 Data quality and security 147 13 Openness and data protection 157 14 Data subjects' rights of access and correction 168 i 15 Exemptions 180 16 Structure, functions and powers of the Privacy 209 Commissioner 17 Transborder data flow 234 18 The media and data protection 244 Appendices 1 Organisations/Individuals from whom submissions on 263 the Consultative Document were received 2 Summary of the Results of the Survey on Privacy 265 Attitudes in Hong Kong conducted by Dr John Bacon- Shone & Harold Traver 3 Briefing note for meeting on Access To Information Bill 278 4 Sample data purposes return from Australia 281 5 Proposed data registration form for Hong Kong 301 ii Introduction ________________ Terms of reference 1. On 11 October 1989, under powers granted by the Governor-in- Council on 15 January 1980, the Attorney General and the Chief Justice referred to the Law Reform Commission for consideration the subject of "privacy." The Commission's terms of reference were: "To examine existing Hong Kong laws affecting privacy and to report on whether legislative or other measures are required to provide protection against, and to provide remedies in respect of, undue interference with the privacy of the individual with particular reference to the following matters: (a) the acquisition, collection, recording and storage of information and opinions pertaining to individuals by any persons or bodies, including Government departments, public bodies, persons or corporations; (b) the disclosure or communication of the information or opinions referred to in paragraph (a) to any person or body including any Government department, public body, person or corporation in or out of Hong Kong; (c) intrusion (by electronic or other means) into private premises; and (d) the interception of communications, whether oral or recorded; but excluding inquiries on matters falling within the Terms of Reference of the Law Reform Commission on either Arrest or Breach of Confidence." 2. This report only deals with (a) and (b). The remaining aspects of intrusion and interception will be dealt with in a later report. What is privacy? 3. A key word in the terms of reference is "privacy". In a recent comprehensive review of the question, Professor Raymond Wacks concludes that "in spite of the huge literature on the subject, a satisfactory definition of 1 'privacy' remains as elusive as ever." 1 Similarly, the United Kingdom committee on Privacy ("The Younger Committee") concluded in its 1972 report that the concept of privacy could not be satisfactorily defined. The Younger Committee viewed its task as identifying the values in which privacy was a major element and then determining which of those values deserved protection. 4. This approach was also taken by the Australian Law Reform Commission in its 1983 report on privacy which noted: "a valid approach in analysing privacy is to isolate and define the interests which are commonly grouped under the heading ‘privacy interests’ and to explore the extent of their legal protection."2 5. The "interests" which the Australian Law Reform Commission thought invariably emerged in any discussion of privacy were: (a) the interest of the person in controlling the information held by others about him, or "information privacy" (or "informational self- determination" as it is referred to in Europe); (b) the interest in controlling entry to the "personal place", or "territorial privacy"; (c) the interest in freedom from interference with one's person, or "personal privacy;" (d) the interest in freedom from surveillance and from interception of one's communications, or "communications and surveillance privacy". 6. Like the Younger Committee and the Australian Law Reform Commission, we have concluded that it is more productive to focus on the commonly agreed privacy interests rather than add yet a further definition of "privacy". Adopting the Australian analysis for this purpose, it will be apparent that item (a), namely "information privacy", corresponds to paragraphs (a) and (b) of our terms of reference. It is this aspect of privacy that is dealt with in this report. 7. It will be noted that the terms of reference refer to information and opinions relating to individuals. The nature of information about individuals varies enormously, from publicly available data such as names and addresses of telephone subscribers, to intimate data referring to an individual's sexual activities. For the purposes of this report "personal information" refers to any information relating to an identifiable individual, 1 Raymond Wacks, Personal Information: Privacy and the Law (Oxford, Clarendon Press, 1989), page 13. 2 Australia Law Reform Commission, Privacy (Report No 22), Canberra: 1983, page 21. 2 regardless of how apparently trivial it is. Information about intimate aspects of an individual's private life will be referred to as "sensitive information." 8. Other points worth noting about the terms of reference are: (a) Whilst "information" is a readily understood term, this report will refer to "data" rather than "information." In particular, the internationally hallowed expression "data protection" will frequently recur. The literature tends to use "information" and "data" interchangeably, but it is important to note that strictly speaking "data" are wider than "information". The distinction has been put as follows: "Information is not a thing, but a process or relationship that occurs between a person's mind and some sort of stimulus. On the other hand, data are merely a representation of information or of some concept. Information is the interpretation that an observer applies to the data."3 Another commentator sums up the distinction by describing "data" as "potential information."4 Because this report's concern is largely with information records, and also to accord with international usage, "data" will be used unless "information" is more apt. It should be stressed that this report is concerned only with personal data. All references to "data" are to "personal data". (b) "Remedies" is wide enough to include, for example, complaints or conciliation procedures, as well as the conventional remedies of criminal or civil sanctions. (c) "Undue interference" recognises that there are other considerations to be weighed against privacy interests, such as freedom of information and, at a different level, business efficiency. (d) The reference is limited to the privacy interests of individuals. In our opinion, corporate and group claims to privacy raise complex issues distinct from those applicable to individuals and which would merit a separate reference. Membership and method of work 9. The Law Reform Commission appointed a sub-committee to examine the current state of legal protection and to make recommendations. 3 D. Piragoff, Computer and Information Abuse: New Legal and Policy Challenges (Department of Justice, Canada, 1989), page 4. 4 Wacks, op cit, page 25. 3 The sub-committee was chaired by the Honourable Mr Justice Mortimer, a judge of the Court of Appeal and member of the Law Reform Commission. The other members of the sub-committee were: Dr John Bacon-Shone Director of the Social Sciences Research Centre, University of Hong Kong Mr Don Brech Former Director, Government Records Service Mrs Patricia Chu Assistant Director, Social Welfare Department Mr Con Conway Director of Community Affairs, Hong Kong Telecom Mr Edwin C K Lau Assistant General Manager, Retail Banking, Hong Kong and Shanghai Banking Corporation Mr James O'Neil Deputy Principal Crown Counsel, Attorney General's Chambers Mr Jack So Executive Director, Hong Kong Trade Development Council (resigned August 1992) Mr Peter So Deputy Commissioner of Police Management, Royal Hong Kong Police Force Professor Raymond Wacks Department of Law, University of Hong Kong Mr Wong Kwok Wah Managing Editor, Sunday Chronicle 10. The Secretary to the sub-committee was Mark Berthold, Senior Crown Counsel, who undertook the extensive research required by this project and on whom fell the considerable burden of drafting the sub- committee's report. We record here our appreciation of Mr Berthold's dedication to his task. We wish also to express our gratitude for the immense amount of hard work devoted to this complex project by the members of the sub-committee. 4 Consultation 11. Over the period of three years preceding the release of its Consultative Document in March 1993 the sub-committee reviewed the relevant legal and specialist literature in fifty-six meetings. This material highlights the international dimension of the protection of privacy. In order to discuss the issues with overseas experts, be they involved in the administration of privacy legislation or as commentators, members attended conferences in Amsterdam and Cambridge in 1991 and the 1992 International Data Protection Commissioners' Conference in Sydney (1992) and Manchester (1993). Officials from a number of other jurisdictions were met at these conferences, as were a number of internationally acknowledged academic experts, consultants and commentators. Members also visited the offices of the data protection authorities of the United Kingdom, Germany, the German province of Hesse, the Netherlands, Quebec, and Australia. We wish to express our gratitude to all those who met the sub-committee or supplied it with written material.