Q&A: protecting privacy and confidentiality in Hong Kong

Protecting privacy and confidentiality

Other than applicable data protection legislation, is there a separate law of privacy in your jurisdiction that regulates the publication of private or confidential information? If yes, what is the test to determine whether an individual’s privacy has been infringed?

The Basic Law, which is the constitutional document of Hong Kong, recognises the freedom and privacy of communication of Hong Kong residents shall be protected by law.

The primary legislation on privacy and data protection is the Personal Data (Privacy) Ordinance (Cap. 486). The purpose of this piece of legislation is to ensure personal data is collected on a fully informed basis and in a fair manner, with due consideration towards minimising the amount of personal data collected. Once personal data is collected, it should be processed in a secure manner and should only be kept for as long as necessary for fulfilling the purpose of collecting such data in the first place.

There is no common law tort of invasion of privacy. Neither is there legislation creating the tort of invasion of privacy. Thus, the protection of individual privacy is only incidental to the granting of relief for recognised torts.

For example, the tort of breach of confidence is traditionally founded on the confidential relationship between the transferor and the transferee of the confidential information. In contrast, the tort of misuse of private information is intended for the protection of publication of information that is personal or private in nature. It is important to note that the tort of misuse of private information has not received formal judicial recognition as a cause of action in Hong Kong.

The statutory offence against the access to computers (including mobile phones) with criminal or dishonest intent established under the Crimes Ordinance (Cap. 200) also has the effect of protecting an individual's privacy.

There is judicial recognition that many would find it difficult to imagine a more intrusive invasion of privacy than the search of a a smartphone because of the scale and variety of materials stored therein.

Are any types of information automatically considered to be private?

The Personal Data (Privacy) Ordinance (Cap. 486) seeks to protect the privacy of individuals in relation to personal data. While the ordinance does not define ‘private information’, it defines ‘personal data’ as any data that can relate directly or indirectly to a person; from which it is practicable for the identity of the individual to be ascertained; and in a form in which access to or processing of the data is practicable.

‘Data’ is further defined as any representation of information (including expression of opinion) in any documents (which in addition to written documents, also include media storage of visual images such as disc, tape and film).

There is judicial recognition that personal particulars on an identity card (such as name, gender, date of birth and identity card number) form part of the 'privacy' of Hong Kong citizens.

Do the attributes of the claimant affect their privacy rights? For example, do public figures have a lower right to privacy?

Privacy rights are protected under the Basic Law and the Bill of Rights Ordinance (Cap. 383). The right is equally enjoyed by people in Hong Kong.

The Personal Data (Privacy) Ordinance (Cap. 486) does not distinguish between public or private figures.

What steps can an individual take to prevent the publication of private information? If applicable, what is the test for a privacy injunction and can it be obtained from the courts on an urgent basis?

Injunctive relief is usually sought to prevent the publication of private information. In an action of breach of confidence, the claimant must establish a ‘reasonable expectation of privacy’ on the information.

In considering whether to grant an interlocutory injunction, the court will consider whether there is a serious question to be tried, whether damages would be an adequate remedy for either side and where the balance convenience lies. However, in situations where the interlocutory injunction would effectively dispose of the claim, the court will instead approach the matter with a broad principle that it will do what will avoid injustice as far as possible, and the claimant has to show they are likely to succeed at trial, which is a higher standard than in an ordinary interlocutory injunction application.

Interlocutory injunctions can be obtained on an urgent ex parte basis if necessary.

What other remedies are available for breach of privacy?

While there is no formal judicial recognition that the tort of misuse of private information is a cause of action in Hong Kong, it is likely courts would eventually do so.

Successful claimants would likely seek damages and delivery up or destruction of documents containing the confidential information.

Privacy is generally regarded as a right of the individual. Do companies have separate means of preventing the disclosure or misuse of confidential or commercially sensitive information?

Confidential or commercially sensitive information such as trade secrets of companies are protected under the common law of confidence and/or terms of employment contracts.

Remedies include injunction, damages, account of profits and delivery up of materials containing confidential information.