This legal update is part of our series discussing the effects of the Personal Data (Privacy) Amendment Ordinance 2012 when it comes into force in Hong Kong.
One of the key changes is that the Privacy Commissioner will soon be conferred with the power to grant legal assistance to any aggrieved person who wishes to seek compensation from a wrongdoer.
So beware: the Privacy Commissioner will flex his muscles to help establish some new case law.
1. Current Position
Currently, under section 66 of the Personal Data (Privacy) Ordinance (PDPO), an aggrieved person may bring legal proceedings in the District Court against a wrongdoer to seek compensation for contravening the PDPO.
However, there is no precedent in Hong Kong indicating the criteria by which, or the extent of the generosity with which, the court may assess and award damages for this type of claim.
Given the legal costs involved in bringing court proceedings, claims of this nature are rare.
2. What's New?
2.1 Privacy Commissioner's power to grant legal assistance
The Amendment Ordinance will soon empower the Privacy Commissioner to provide various forms of legal assistance to a person who has a right to claim compensation for damage suffered as a result of the data user's contravention of the PDPO.
We understand that this part of the Amendment Ordinance will come into force in or around January 2013.
To help an aggrieved person decide whether to commence court proceedings, the Privacy Commissioner will produce new prescribed forms that the aggrieved person or the data user (e.g., an employer) may use in questioning and replying.
If the aggrieved person questions the data user, and the data user does not answer or is evasive in its reply, the District Court may draw an adverse inference from this.
2.2 What factors would the Privacy Commissioner consider?
An aggrieved person may apply for legal assistance to the Privacy Commissioner, who will consider whether:
- the case raises a question of principle; or
- it is unreasonable, having regard to the complexity of the case or the aggrieved person’s position, to expect the aggrieved person to deal with the case unaided.
Based on his consideration of the above factors, the Privacy Commissioner may grant legal assistance if he thinks fit to do so.
2.3 What form of legal assistance may be granted?
The Privacy Commissioner may assist by:
- giving advice;
- arranging for advice or assistance to be given by a solicitor or barrister;
- arranging for representation by a solicitor or counsel in court, or in reaching a compromise; and
- giving any other form of assistance as he considers appropriate.
2.4 Can legal costs be recovered in these court proceedings?
Employers should be aware that unless the court proceedings are brought maliciously or frivolously, or there are special circumstances which warrant an award of costs, each party usually bears their own costs in any court proceedings brought under the PDPO.
3. Views of the Privacy Commissioner
With the power to grant legal assistance, the Privacy Commissioner will flex his muscles to help establish some new legal precedents. He will use this opportunity to enhance public awareness of privacy issues.
The Privacy Commissioner's Office has indicated that the Privacy Commissioner will likely refer to overseas cases (particularly to cases in Australia) to help establish the criteria and levels of generosity for assessing compensation.
4. Compensation Awards
As our tips to employers (and other data users), the following is a summary of some of the principles derived from data privacy cases in Australia for awarding compensation:
- Where a complaint is substantiated and loss is suffered, the privacy legislation contemplates some form of redress in the ordinary course;
- Awards of compensation should be restrained but not minimal;
- Aggravated damages may be awarded in appropriate cases;
- Compensation should be assessed having regard to the complainant’s reaction, as opposed to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances;
- The court may seek assistance from decisions which interpret similar provisions in other legislation. For instance, awards for injury to feelings may be made with reference to discrimination and harassment cases.
- In Australia, the range of award would range from A$1,000 to A$25,000. For ‘serious breach’ of the privacy legislation, the amount of compensation would be A$8,000.
- Apologies could affect the amount of damages awarded. So apologies should be more than mere platitudes.
To minimize the risk of litigation, employers are well advised to review their existing systems and procedures in collecting and managing their employees' personal data.