Privacy Law and Policy Reporter
The typhoon season in Hong Kong has witnessed a tempestuous debate, provoked by the publication of two consultation papers by the Law Reform Commission’s privacy sub-committee. One proposes, inter alia, the establishment of an independent Press Council for the Protection of Privacy. It was greeted by a storm of condemnation in the media — which is not entirely surprising, since the press itself obviously has a direct interest in the matter. The other paper recommends more sweeping safeguards for privacy; notably, the creation of a statutory tort of invasion of privacy. It has passed almost unnoticed.
Also escaping much publicity is the news that the Privacy Commissioner for Personal Data has survived the first judicial review of the exercise of his power. The decision raises a number of fundamental questions about the character and scope of the Personal Data (Privacy) Ordinance.
Press freedom is a sensitive subject in Hong Kong. While neither the Chinese authorities nor the Hong Kong Government have exhibited an inclination to control the press, there are, despite the promises contained in the Basic Law and the Bill of Rights Ordinance, legitimate fears that should this freedom prove uncongenial, a chill could swiftly begin to blow from the north.
The Law Reform Commission’s consultation paper should be read against that background, but it hardly justifies the ill informed hysteria that, as I write, shows little sign of abating. The members of the sub-committee have been dubbed government stooges. We can, I think, handle this sort of offensive blather, but it does rather inhibit the exercise of rational debate that presumably the press wishes to foster. The Commission, it is true, is housed in the Department of Justice and its chairman is the Secretary of Justice. But there is absolutely no evidence of the Government, or anyone else, applying pressure to the sub-committee. Our errors are our own. Blaming the Government (and dismissing the proposed Press Council, whatever its shortcomings, as ‘a government controlled body’) is unhelpful.
The sub-committee was in little doubt that a problem existed. Certain Chinese language newspapers are notorious for their explicit, occasionally disturbing, photographs of injured, dying or even dead individuals. Intrusions into private grief are not uncommon. Concern for privacy is not immediately evident in the conduct of the three papers that have a 70 per cent share of the market, nor is there evidence of any serious attempt by the media to regulate itself. Indeed, these three papers are not members of the Newspaper Society that, in any event, plays a very limited role in maintaining, let alone enforcing, ethical standards.
The sub-committee concludes that, though the Privacy Commissioner had the power to issue a code of practice for the news media, the limitations of the Data Protection Principles necessitated more explicit measures. It therefore recommends the establishment of a statutory Press Council for the Protection of Privacy, comprising an equal number of press members and public members appointed by an independent Appointments Commission. Its jurisdiction is to be restricted to matters related to privacy, upon which it would be charged to lay down the standards for compliance by the press. It would have no power to interfere with the internal workings of news organisations.
Principal features of the proposed body include the following:
The sub-committee’s proposed new torts spring from the recognition that neither the Personal Data (Privacy) Ordinance nor the common lawafford adequate protection against invasions of privacy by ‘intrusion’ or ‘disclosure’. Based on the concept of a ‘reasonable expectation of privacy’, the committee concludes that an individual has such an expectation in their private affairs and when they are in a state of solitude or seclusion. It therefore proposes that a person who invades another person’s privacy by intruding upon their solitude or seclusion, or by intruding into their private affairs or concerns, should be liable in tort. A second tort is recommended for invasion of privacy arising out of the public disclosure of private facts.
To prevent frivolous and vexatious claims, the notion of ‘offensiveness to a reasonable person’ is included as an element of the two torts, and public disclosure that could be justified in the public interest is to be protected. It is therefore proposed that it should be a defence to an action for public disclosure of private facts if:
It is also a defence that the intrusion or publication was reasonably necessary for the protection of the person or property of an individual.
Eastweek, a popular Chinese magazine, published a photograph of a young woman to illustrate an article on fashion. Her image, taken with a long range lens as she stood at a busy intersection, was used as an example of poor dress sense. Needless to say, she consented to neither the photograph nor its subsequent uncharitable publication. Her successful complaint to the Privacy Commissioner was based on a breach of the first data protection principle (DPP 1) in Sch 1 of the Ordinance requiring, inter alia, that personal data be collected by means that are ‘fair in the circumstances of the case’.
Keith JA (sitting as an additional judge of the Court of First Instance) rejected the magazine’s argument that, since it wanted to capture the complainant’s picture in a ‘natural pose’, its non-consensual long range shot was justified. And he gave short shrift to its claim that, since the Commissioner had accepted that it would have been impractical to obtain the complainant’s prior consent to a candid photograph, such a picture could be taken without her knowledge.
This, the learned judge opined, was an erroneous construction of the Commissioner’s decision, for he had not found the taking of the photograph to have been unfair solely on this ground:
What rendered the taking of the photograph unfair was the fact that it was taken without the complainant’s knowledge or consent at a time when (a) the photographer did not have reasonable grounds for thinking that he would be able to obtain her consent to its publication, and (b) the magazine did not have a policy of publishing someone’s photograph (obtained without the person’s knowledge or consent) in such a way that the person cannot be identified.
Nor, the court held, was this a matter of the photographer’s subjective judgment. The Commissioner had ruled that the photographer had no reasonable grounds to believe that the complainant’s consent could be obtained to the publication of her photograph. Keith JA observed that the fairness of the means by which personal data are to be collected depends on the circumstances of the case: ‘It would be absurd if a wholly unreasonable belief that such means are fair could render fair means which would otherwise be regarded as unfair.’
In upholding the Commissioner’s ruling, the court has, perhaps unwittingly, acknowledged that the reach of the Ordinance extends well beyond the realm of ‘data protection’, and includes the press. This is a view that I have myself advanced,but it is far from uncontroversial.
A viable alternative to both, I have argued, lies in an expanded Personal Data (Privacy) Ordinance. Though it was not forged for this purpose, its legislative regime could, with only minor amendment, be extended to afford relief to victims of unwanted publicity.
Indeed, this is precisely what it achieved in Eastweek. The complainant was vindicated. Small fry, perhaps, but there was no suggestion by the magazine that its ‘journalistic activity’ fell beyond the orbit of the law.
Three aspects of the judgment warrant comment. First, there is little doubt that the mischief addressed by three generations of data protection lawis the misuse of personal data rather than the activities of the press. Indeed, the European Directive on Data Protection explicitly exempts the press from its purview. While the judgment of Keith JA acknowledges this fact,the learned judge nevertheless appears untroubled by the application of the Ordinance to the conduct of journalists.
Second, it is doubtful whether press freedom is served by the unduly narrow conception of ‘news gathering’ adopted by the Commissioner and accepted by the judge. Those engaged in a ‘news activity’ are exempted by s 61 from, inter alia, the requirement to provide data subjects with access to personal data held about them. The Commissioner was not persuaded that the snap of a woman in a ‘lifestyle’ article was ‘news gathering’ even if that phrase could be equated (as the publisher contended) with the definition in s 61(3) of ‘news activity’ to mean ‘any journalistic activity’ and includes ‘observations on ... current affairs’. The court considered this a tenable view, holding that the Commissioner ‘was entitled to conclude that it was no more than an article illustrating and commenting on the ability of various women who were photographed to choose clothes and accessories which co-ordinated with each other’. This is an unduly restrictive understanding of what journalists do.
Third, Keith JA was reluctant to accept that a photograph fell within the Ordinance’s definition of ‘data’ as ‘any representation of information ... in any document’. His view was that ‘data’ related to information about someone, such as a bank balance, and he confessed that he was ‘extremely sceptical’about whether the photograph of the complainant constituted data about her. A closer reading of the Ordinance, however, would have revealed that the term ‘document’ is defined in s 2 to include ‘a film, tape or other device in which visual images are embodied’. A photograph is plainly included. In our digital world, it could not be otherwise.
In the current debate generated by the Law Reform Commission’s two consultation papers, the notion that the Privacy Commissioner should be charged with striking the balance between privacy and press freedom has found little favour. But it is already happening — and it is no bad thing.
While the advent of the internet compels us to re-conceptualise both ‘privacy’ and ‘free speech’, and the tension between them, the central questions are unlikely to change in our digital age. The problem of ‘balancing’ these competing rights has, however, become something of a cliché to be approached with caution, and I am uneasy about the fault based, individual centred analysis of privacy that seems to me to have failed. An information oriented, control based account of privacy offers, I believe, a more promising route towards effective protection of this enigmatic right. The position of the Privacy Commissioner, fashioned in many jurisdictions to achieve a rather different, more modest, objective, may turn out to provide a workmanlike solution to this intractable puzzle.
Raymond Wacks is Professor of Law
and Legal Theory at the University of Hong Kong. He has been writing about privacy for 25 years. We welcome him to the Editorial Board of Privacy Law and Policy Reporter.