Hong Kong courts clarify personal data concerns in civil litigation
In a series of cases in Hong Kong in the last year or so, the courts have brought some welcome clarification to the vexed issue of the interaction between disclosure of relevant documents in civil disputes and balancing competing confidentiality and personal data concerns arising out of the contents of such documents.
Summary
While it is clear that the courts in Hong Kong will normally come down in favour of ensuring that all relevant materials in a civil dispute are disclosed, they can (in certain circumstances) do so in such a way as to limit access to confidential information and/or the purpose for which documents disclosed are used. It is also clear that the courts in Hong Kong are generally sceptical of attempts to limit disclosure of documents in civil disputes on the grounds that to do so would infringe personal data protection principles.
Background
Between 2012 and 2014 a number of cases began to surface in which the courts in Hong Kong criticised certain public authorities for apparently using personal data laws in an attempt to thwart parties' legitimate attempts to gain access to documents in those authorities' possession. Indeed, one particular public authority came in for particular criticism as being obstructionist in response to road traffic victims' requests for relevant documents in the police's possession [1].
What came out of these cases is that the administration of justice is paramount and that normally includes ensuring civil disputes are determined on the basis of all available relevant material in order to arrive at a just and fair result. Refusal to hand over documents to litigants on the basis of purported personal data protection principles was often a misunderstanding of the law. In particular, section 60B of the Personal Data (Privacy) Ordinance (Cap. 486 – PDPO) makes it clear that the prohibition on using personal data for a purpose other than for which it was collected (save with the consent of the data subject) does not apply if the use of the data is (among other things) required by law or by order of the court, or in connection with any legal proceedings in Hong Kong or for establishing, exercising or defending legal rights in Hong Kong [2] . This is not to suggest that a litigant seeking access to relevant documents in another party's possession (or, indeed, in a third party's possession) has an unqualified right to access personal data in those documents.
Recent cases
In the recent judgment of Ng Shek Wai v Medical Council of Hong Kong [3], the applicant through judicial review proceedings sought to quash the Medical Council's decision to refuse to disclose the identities of participants in a disciplinary inquiry involving a doctor (including the identities of members of the disciplinary inquiry, its legal adviser and the defence counsel).
The Council originally refused to disclose the information on the basis that it amounted to personal data and (without the consent of the data subject) its use was restricted to the purpose for which it was originally collected [4]. The Council's reluctance in giving the information to the applicant may have in large part been because the applicant was a member of the public, who was not connected with the proceedings and it was not entirely clear why he wanted the information.
That said, the High Court quashed the Council's decision to refuse to disclose the information and remitted the matter back to it for further adjudication.
In an interesting and detailed judgment, the court held that if disclosure was required in the interests of open justice (as in this case) then Data Protection Principle 3 (DPP3 – limiting the use of data to the original purpose for which it was obtained) was no obstacle to disclosure. The court noted that section 60B of the PDPO permitted certain exemptions to DPP3 and, in this case, section 60B(a) applied [5].
The court was careful to note that an exemption contained in section 60B of the PDPO did not mandate disclosure; rather, it made it clear that DPP3 was not an obstacle. The court still had an overriding discretion in the matter and the court was required to assess whether the principle of open justice required disclosure of the information in the circumstances.
The court went on to find that as a starting point the principle of open justice applied to all tribunals that sat in public and that exercised a judicial power. This included not just public access to the court or tribunal, but usually also disclosure of basic information about the identities of the key persons who took part in a public judicial hearing; for example, the identities of the Council's legal adviser, the tribunal members and the defence counsel.
In determining whether the principle of open justice required the information to be disclosed, the court looked at all the circumstances of the case; in particular, including the nature of the information sought and the nature of the tribunal. What advanced the case for disclosure in this case was that the applicant was not seeking access to documents or information which (on the face of it) would not normally be revealed. He merely wanted the names of the key players who took part in the tribunal hearing. Further, and importantly, the Council hearing was in public and no example was given to the court of a judicial tribunal in Hong Kong which handed down written decisions without identifying the members who are a party to those decisions (besides the name of the Chairperson).
The decision in Ng Shek Wai v Medical Council of Hong Kong is hardly surprising on its facts and the Council's original decision to refuse the applicant the information seems strange (besides being a misapprehension of DPP3).
In fairness, the Council's legal adviser may have been concerned as to the applicant's motives in wanting to obtain access to the information sought.
The court's focus on the common law principle of open justice is (in part) a reflection of the fact that there is no freedom of information legislation in Hong Kong and the court did not decide the difficult issue of the interaction between the constitutional right to freedom of expression and the right to obtain information from public bodies [6].
For another recent case on disclosure of information to which a party objects on the grounds of personal data protection and/or issues of confidentiality, readers should refer to the comprehensive judgment of the High Court in Chan Yim Wah v New World First Ferry Services Ltd [7].
In brief (and at the risk of doing disservice to the facts), the plaintiff sought disclosure of documents from the Director of Marine with respect to a ferry incident in Hong Kong waters in 2011. Disclosure was sought to assist the plaintiff's clam for personal injury damages against the defendant. The documents sought were in the nature of (among others) a marine safety report and early witness statements. The Director objected to disclosure on a number of grounds, including (originally) DPP3 and confidentiality; the possibility of prejudice to criminal proceedings was also raised, although no such proceedings had transpired since the incident and the plaintiff's request.
Eventually, the Director gave up the objection based on DPP3, no doubt reflecting on previous judicial comments in this regard. The main objections to disclosure for determination by the court were confidentiality and the alleged prejudicial effect on any criminal prosecution. However, as with previous cases, the court also saw fit to give substantive guidance to public bodies on the interaction between personal data protection principles and disclosure of documents in civil proceedings in Hong Kong [8].
In short, the court's decision confirms that in deciding whether to order disclosure of documents to a party in civil proceedings in Hong Kong, the court has a wide discretion and considers three criteria; relevance, necessity and discretion (the latter based on the same sort of balance of public interest considerations raised in Ng Shek Wai v Medical Council of Hong Kong).
Confidentiality
The court noted the practice of the Marine Department was to keep statements of eye witnesses confidential, absent a court order or the consent of the witness. However, this practice did not affect the court's discretion to override confidentiality arising out of statute or common law. The court had to balance the public interest in ensuring courts try cases on the basis of all available relevant materials and the public interest in protecting confidentiality in investigations (noting that some investigations were more deserving of confidentiality than others eg contrasting more routine road traffic or occupational safety reports with marine accidents). The interest in disclosure would generally outweigh confidentiality.
Criminal investigation
Given the passage of time since the incident made it unlikely that a prosecution would follow, the court favoured disclosure of the Marine Department's report and the witness statements; also noting that they were highly relevant to the plaintiff's claim against the defendant ferry operator.
In order to assuage the Director of Marine's concerns about wider access to the report and witness statements, disclosure was ordered subject to strict conditions; including, limiting access to the parties in the proceedings and their advisers and only for that purpose and with the possibility of redaction of any particularly sensitive matters; such as inappropriate personal details and privileged information (subject to agreement between the parties or, failing that, approval by the court). In our experience, in these sorts of circumstances, such conditions are common place and recommended.
Personal data
This part of the court's judgment was strictly obiter (the Director of Marine having conceded the point concerning DPP3). However, noting a degree of misapprehension concerning the ambit of personal data protection principles in the context of disclosure in civil proceedings, the court saw fit to comment on this issue. In brief, the court noted:
- "Personal data" has a limited meaning and an individual did not have an unfettered right to access every document just because it referred to him or her [9].
- Whether the disclosure of documents containing personal data in civil proceedings amounted to a "new purpose" for the purpose of section 3(4) of DPP3 is an issue to be decided on the facts of a case [10].
- The exemptions contained in section 60B of the PDPO were wider than those contained in DPP3 eg, for the exemption in section 60B to apply there was no need to show certain prejudice as there was with the operation of DPP3.
- The exemptions to DPP3 and in section 60B of the PDPO did not create a legal basis to seek or to compel disclosure of information that otherwise contained personal data (a point also made in Ng Shek Wai v Medical Council of Hong Kong) [11].
- Investigating agencies could invoke the protection afforded in section 60B of the PDPO when disclosing information containing personal data to victims of accidents. If they were genuinely in doubt whether to disclose, they could ask an applicant to obtain a court order (thereby, coming within section 60B(a)).
- Where the court considered documents were relevant and necessary to be disclosed pursuant to a court process, it retained an overriding discretion (based on, among other things, competing public interests between transparency and privacy; with the courts usually preferring transparency). If section 60B of the PDPO applied there was no countervailing privacy right to consider.
Some comment
The interaction between disclosure procedures in civil litigation and personal data protection principles in Hong Kong has caused much confusion in recent years. These recent cases should bring some welcome clarification to what can be a difficult area of the law. It is clear that these recent judgments do clip the wings of so-called "personal data enthusiasts" (or those who assert personal data out of convenience). Going forwards, public bodies and tribunals in Hong Kong will need to pay more careful attention to requests for information that involve access to personal data. No longer should a public body or tribunal simply recite "personal data" or "data privacy" as an all embracing excuse to avoid disclosing information to bona fide applicants.
For those hoping for an end to these sorts of disputes, they are likely to be disappointed. We anticipate further court disputes in Hong Kong concerning the interaction between personal data protection principles and disclosure procedures in civil disputes eg the application of the meaning of a "new purpose", the scope of the meaning of "personal data" in different contexts, and further court decisions as a result of some cautious public or tribunal officials seeking to invoke the protection of section 60B (to name but a few).
In the meantime, data users (holders) in Hong Kong should review their personal data protection policies and give careful thought to how they handle requests for information. They should also be careful how they generate new documents generally and that contain a data subject's personal data. If in doubt about the disclosure of documents containing personal data and confidential information, take early legal advice and seek to limit (for example) the purposes for which and the parties to whom disclosure is made [12].
A PDF version of the article can be found here.
This article is intended to give general information only. It is not a complete statement of the law. It is not intended to be relied upon or to be a substitute for legal advice in relation to particular circumstances.
Written by Warren Ganesh.
_________________________________________
[1] Chan Chuen Ping v Commissioner of Police [2014] 1 HKLRD 142; Chan Wai Ming v Leung Shing Wah [2014] 1 HKLRD 376 (and CACV No. 266 of 2013, July 3 2014 - an appeal, in which the issue of disclosure did not arise).
[2] Section 58 of PDPO also (among other things) contains exemptions to restrictions on the use of personal data and the right access to personal data, where those provisions would (for example) prejudice the prevention or detection of crime (and the like) or the "remedying of unlawful or seriously improper conduct" (which has been construed widely to include remedying civil wrongs, in addition to the ambit of the exemptions in section 60B of the PDPO - see footnote 5).
[3] [2015] 2 HKLRD 121.
[4] Data Protection Principle 3 of Schedule 1 of the PDPO prohibits the use of personal data for a new purpose without the consent of the data subject.
[5] Section 60B(a) of the PDPO exempts personal data from DPP3 ("Use of personal data"), if the use of such data is required or authorised by or under any enactment, rule of law or order of a court in Hong Kong. Section 60B(b) exempts with respect to the use of personal data required in connection with any legal proceedings in Hong Kong. Section 60B(c) exempts with respect to the use of personal data required for establishing, exercising or defending legal rights in Hong Kong.
[6] Article 16 of the Hong Kong Bill of Rights Ordinance (section 8 - Cap. 383) and Article 27 of the Basic Law of the Hong Kong SAR.
[7] [2015] HKEC 762, HCPI No. 820 of 2013, 8 May 2015.
[8] See footnote 1.
[9] Section 2 of the PDPO.
[10] Much appears to depend on the court's assessment of "the reasonable expectations of the data subject": Ng Shek Wai v Medical Council of Hong Kong (paragraph 52).
[11] See paragraph 49 of the judgment in Ng Shek Wai v Medical Council of Hong Kong and paragraph 85 of the judgment in Chan Yim Wah v New World First Ferry Services Ltd. Also see section 51 of the PDPO.
[12] See briefing, March 2014 - "Protecting documents in disputes", Warren Ganesh & Rebecca Sargent (nee Williams).