AustLII Home | Databases | WorldLII | Search | Feedback

Privacy Law and Policy Reporter

Privacy Law and Policy Reporter (PLPR)
You are here:  AustLII >> Databases >> Privacy Law and Policy Reporter >> 2000 >> [2000] PrivLawPRpr 11

Database Search | Name Search | Recent Articles | Noteup | LawCite | Help

Wacks, Raymond --- "What has data protection to do with privacy?" [2000] PrivLawPRpr 11; (2000) 6(9) Privacy Law and Policy Reporter 143

What has data protection to do with privacy?

Raymond Wacks

Murkiness abounds in the privacy jungle. The question of the relationship between data protection legislation and the right of privacy has long inhabited this murk. The two plainly overlap; indeed, the latter is normally invoked as the interest which animates the former. But even in our burgeoning information society, ‘privacy’ is not necessarily violated by what we once called ‘data banks’.[1]

To some extent, of course, data protection (fashioned to regulate some of the problems generated by the collection, use, storage and transfer of personal data) can and does protect individuals’ ‘privacy’. When this claim is made it normally means, I think, not that data protection laws can or should resolve the wider questions that, especially in the US, are accommodated under the ever expanding umbrella of ‘privacy’ (abortion, contraception, homosexuality and so on), but whether personal information obtained by intrusive conduct or gratuitously disclosed by the media lies outside the scope of such legislation.

This is not a matter of mere academic interest; the application of data protection to matters that are considered by many to lie beyond its orbit is now a reality. The collection and use of personal data by the media is the most conspicuous example of this development, though the European Directive on Data Protection explicitly exempts the press from its purview.[2] This article, while it may have wider application to data protection legislation in other jurisdictions, is confined to a problem that has arisen in my own.

Privacy Commissioner wrong

I recently reported in these pages[3] the first judicial review of Hong Kong’s Privacy Commissioner for Personal Data[4] under the Personal Data (Privacy) Ordinance.[5] The Commissioner survived the challenge, but that decision has just been reversed by the Court of Appeal.6

Attentive readers will recall that the defendant, a popular Chinese magazine, published a photograph of a young woman to illustrate an article on fashion. Her image, taken with a long range lens as she stood at a busy intersection, was used as an example of poor dress sense. She consented neither to the photograph nor to its subsequent unkind publication. Her successful complaint to the Privacy Commissioner was based on a breach of the first data protection principle (DPP 1) in Sch 1 of the Personal Data (Privacy) Ordinance requiring, inter alia, that personal data be collected by means that are ‘fair in the circumstances of the case’.

The learned judge rejected the magazine’s argument that since it wanted to capture the complainant’s picture in a ‘natural pose’, its non-consensual long range photograph was justified. And he gave short shrift to its claim that since the Commissioner had accepted that it would have been impractical to obtain the complainant’s prior consent to a candid photograph, such a picture could be taken without her knowledge.

This, he held, was an erroneous construction of the Commissioner’s decision, for he had not found the taking of the photograph to have been unfair solely on this ground:

What rendered the taking of the photograph unfair was the fact that it was taken without the complainant’s knowledge or consent at a time when (a) the photographer did not have reasonable grounds for thinking that he would be able to obtain her consent to its publication, and (b) the magazine did not have a policy of publishing someone’s photograph (obtained without the person’s knowledge or consent) in such a way that the person cannot be identified.[7]

The Court of Appeal (by a majority) has now held that the facts fell outside of the ambit of the legislation. Neither DPP 1 nor any of the data protection principles were ‘engaged’. The Privacy Commissioner had therefore been wrong to rule against the magazine.

The appeal

The judgment rests on four main grounds. First, the act of photographing the plaintiff did not constitute an act of data collection. This was because:

the essence of the required act of personal data collection [is] that the data user must thereby be compiling information about an identified person or about a person whom the data user intends or seeks to identify. The data collected must be an item of personal information attaching to the identified subject ... This is missing in the present case. What is crucial here is the complainant’s anonymity and the irrelevance of her identity so far as the photographer, the reporter and Eastweek were concerned. Indeed, they remained completely indifferent to and ignorant of her identity right up to and after publication of the offending issue of the magazine. She would have remained anonymous to Eastweek if she had not lodged a complaint and made her identity known. In my view, to take her photograph in such circumstances did not constitute an act of personal data collection relating to the complainant.[8]

Second, to apply DPP 1 to the facts of the case would unduly inhibit press freedom, since a newspaper may wish to publish photographs of unidentified persons to illustrate some social pheno-menon, such as teenagers smoking.

Third, other provisions of the Ordinance (such as access rights and the use limitation requirement in DPP 3) point to the necessity for a data subject whose identity is known or sought to be known by the data user as an important item of information. In other words, the right of access, for example, makes sense only if the data user holds the data collected in relation to each identified data subject. This was of course not the case here.

Fourth, the Ordinance protects only personal data; it is not intended to create a general right of privacy against all forms of intrusion into the private domain.

The court stressed that it was not deciding that taking someone’s photograph could never be an act of personal data collection. It depended on the circumstances:

Thus, if someone’s photograph is taken with a view to its inclusion as part of a dossier being compiled about him as an identified subject, the act of photography would clearly be an act of personal data collection. For example, the portfolio of photographs of particular actors, entertainers or fashion models maintained by a theatrical impresario or fashion modelling agency would clearly constitute personal data collected in relation to the individuals in question. Similarly, law enforcement agencies are likely to have databases including photographs of wanted persons whose identities may or may not be known. If unknown, their identities would be considered important and sought-after items of information. Such photographs clearly would constitute part of the personal data collected in relation to such wanted persons.[9]

Moreover, none of the three judges doubted either that a photograph could constitute ‘personal data’ (an issue upon which the trial judge had expressed uncertainty)[10] or that the press or other media organisations fell beyond the scope of the Ordinance. ‘On the contrary, it is clear that they are caught by its provisions if and to the extent that they engage in the collection of personal data.’[11]

Collection or use?

What was the complainant’s grievance? She was in a public place when her photograph was taken without her knowledge or consent. It is doubtful that the ‘privacy’ laws of any jurisdiction would regard her as having, on these facts, a reasonable expectation of privacy. Even the American common law tort of ‘intrusion’ would be of little help — unless perhaps she exhibited by her conduct a desire to preserve her privacy and this was reasonable in the circumstances.[12]

Ironically, therefore, DPP 1 (which requires the collection of personal data to be ‘fair’) may provide greater protection to ‘privacy’ than the US tort that exists for this very purpose. But the matter is not so simple. First, as already mentioned, the court rejected the view that this was collection of personal data at all. Second, the relationship between what may be called (even in the present context) ‘intrusion’ and ‘disclosure’ is problematic.

I shall not deal here with the first point, though I hope to do so in a future article.[13] The second issue has long bedevilled the literature of ‘privacy’; its analysis is, however, neglected in the data protection setting.

In short, there is normally little point in taking my photograph unless it is to be used for some purpose. My objection to being photographed, whether in a public or private place, usually resides in the frustration of my legitimate expectation that my image should not be used without my consent.[14] There is therefore a symbiotic relationship between use and disclosure or, to use the language of data protection, collection and use. The Court of Appeal proceeds on the (common) assumption that the two are, in effect, inseparable. But caution is required.

Intrusion or disclosure?

A similar presumption is to be found in common law ‘privacy’ cases and literature, where there is a tendency to conflate the intrusion practised by the prying journalist or photographer with the publication of the information thereby acquired. I want to suggest that, as far as possible, the two be kept separate.[15]

Hence, to make an obvious point, the intruder may not always be the ‘discloser’. Thus in Pearson v Dodd[16] employees and ex-employees of a US senator surreptit-iously removed papers from his files, copied them and handed the duplicates to two newspaper columnists. The journalists, with full knowledge of the circumstances of its acquisition, included the information in their column. The court, dealing separately with disclosure and intrusion, held that, in respect of the former, the First Amendment protected the revelation of such information and, as to the latter, the columnists could not be liable for the intrusion merely upon proof of their knowledge of its occurrence.

First Amendment protection extends only to disclosure. Hill points out, in regard to the protection afforded to the media by the newsworthiness defence to otherwise actionable disclosures of private facts, that ‘[t]he values of the First Amendment would be seriously subverted if such protection were withdrawn on the ground of knowledge on the part of the media that the truth had come to light through legally reprehensible means employed by others’.[17]

Should such protection be accorded to intrusion? I think not. The justifications for free speech do not apply to cases of intrusion. Thus, as Dietemann correctly held, the media should be liable for intrusive investigative activities. Accord-ingly, the central question becomes whether mere knowledge on the part of the columnists in Pearson ought to have been sufficient to hold them liable for the tort of intrusion.

Where the ‘discloser’ is also the intruder, liability should be imposed for the intrusion even though the disclosure is safeguarded by free speech consider-ations. Dietemann protects the journalists’ disclosure of newsworthy information to the public at large, while reproving their intrusive newsgathering. This seems a sensible approach.[18]

In most mixed intrusion/disclosure cases, but for the reprehensible newsgathering techniques, the defendants would not have got their story. And equally, but for those techniques, not only would the plaintiff not have suffered a violation of his seclusion but he also would have been spared the trauma of being named in the newspaper. However, in Barber the Missouri Supreme Court declined to protect the journalist, and thus the plaintiff recovered damages for both intrusion and disclosure.

Applying the analysis to data protection

Does this approach have any purchase in respect of the data protection principles regulating collection and use of personal data? Each is, of course, targeted at a rather different mischief than the privacy considerations deployed in the cases mentioned above. Thus, the latter, for example, includes not merely ‘disclosure’ of information, but any use of it. Moreover, and perhaps more significantly, it embodies the principle that data collected for one purpose should be used for another purpose only with the prescribed consent of the data subject. I have argued that this is a core ‘privacy’ right, but this view may not be widely shared.[19]

In any event, the reference in DPP 3 to ‘the purpose for which the data were to be used at the time of the collection of the data’ demonstrates a similar inter-connectedness between this principle and DPP 1. Nevertheless, the argument in support of treating the wrongfulness of each form of conduct discretely remains. This means that the act of data collection should be evaluated independently of the use to which the data are put.

In addition, though the complainant’s objection was to the use rather than the collection of the data,[20]where a data protection regime is applied to the media, it may be necessary to treat the notion of collection in a less restrictive manner.[21]

It is hard to dispute the reasoning of Ribiero JA that led him to conclude that if no complaint had been made to the Commissioner and, a year later, Eastweek had been requested to provide any information that it had relating to the complainant, the magazine would have responded that it had no records relating to such an individual, even if the offending photograph and article remained available in its electronic and print archives. The information ‘would not have been collected in or intended to be retrievable from such archives as personal data relating to the complainant’.[22]

But there may well be circumstances in which a data subject may seek access to data that identify him only by his image. Suppose, for example, that my activities in public are — as increasingly is the case —monitored by means of closed circuit TV. I fear that the video recording may have captured me in an embarrassing situation and I wish to obtain a copy of this piece of personal data. Leaving aside the nice question of how access might operate in practice, the mere fact that I am identified on the tape is not conclusive of the question of whether the law protects that right.

Similarly, if I know that my photograph has been taken, even if my name is not revealed in the accompanying article (as occurred in this case) the offending newspaper, though it has no interest in my identity, ought to be able to retrieve the picture when I inform them when and where it was shot. Anonymity of the data subject need not be the death knell of fair collection.


I believe that the data protection principles provide a sound basis for the protection of individual privacy. Placing control of personal information at the heart of our deliberations about privacy achieves what the orthodox analysis has conspicuously failed to do: it postulates a presumptive entitlement accorded to all individuals that their personal data may be collected only lawfully or fairly and that once obtained, it may not be used, in the absence of the individual’s consent, for a purpose other than that for which it was originally given.

This approach is not, of course, a panacea. The challenge of striking a balance between privacy and competing interests remains, but we need to rethink the conceptual underpinnings of privacy if we are to arrest its relentless decline.

Raymond Wacks, Professor of Law and Legal Theory, University of Hong Kong.

[1] Twenty years ago I wrote: ‘Even if “privacy” is assigned the meaning most favourable to this view namely that “privacy” consists in the individual’s ability to control the circulation of information about himself ... the proposition [that privacy is invaded by computerised data banks] is unconvincing. It fails to account for other objections raised against data banks ... such as their security, the storing of “opinion” rather than “fact”, and the relevance of the information garnered to the purpose of its storage ... It is too shallow a view to see even in the misuse of personal information held by computers an automatic invasion of “privacy”. What is lost is not so much “privacy” as the value of “privacy”, and this value would be more effectively protected by attending to the specific problems generated by the growing use of data banks. To raise the cry of “invasion of privacy” obstructs the careful and rational solution these problems require’: Wacks R, ‘The Poverty of “Privacy”’ (1980) 96 Law Quarterly Review 73, 87 (footnotes omitted).

[2] Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, Official Journal of the European Communities 23 November 1995, No L 281, p 31. The Directive provides that in the case of ‘the processing of sound and image data carried out for purposes of journalism or the purposes of literary or artistic expression ... the principles of the Directive are to apply in a restricted manner according to the provisions laid down in Article 9’. Article 9 requires Member States to provide for exemptions or derogations for the processing of personal data ‘carried out solely for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression’.

[3] Wacks R, ‘Privacy and media intrusion: a new twist’ (1999) 6 PLPR 48-51.

[4] Eastweek Publisher Ltd v the Privacy Commissioner of Personal Data [1999] HCAL 98/98.

[5] See generally Berthold M and Wacks R, Data Privacy Law in Hong Kong FT Law & Tax, Hong Kong 1997.

[6] Eastweek Publisher Ltd v the Privacy Commissioner of Personal Data [2000] CACV 331/1999.

[7] At 10-11 (emphasis in original).

[8] At 10-11 (emphasis in original).

[9] At 17.

[10] In my earlier article (see note 3 above) I suggested that a closer reading of the Ordinance would have revealed that the term ‘document’ is defined in s 2 to include ‘a film, tape or other device in which visual images are embodied ...’ and so a photograph is plainly included. The Court of Appeal accepted this view.

[11] At 18.

[12] Is her real complaint one of libel? The judgment refers to her being embarrassed and teased by her friends and that the article sought to provide ‘a degree of malicious amusement’ to readers of the magazine at the complainant’s expense. This, it is submitted, is unlikely to form the basis of a cause of action in defamation, but see Wong JA’s dissenting judgment (at 26 –27).

[13] The Court of Appeal acknowledged that the complainant was ‘entirely justified in regarding the article and the photograph as an unfair and impertinent intrusion into her sphere of personal privacy. However, unfortunately for her, the Ordinance does not purport to protect “personal privacy” as opposed to “information privacy”’ (at 20, per Ribiero JA). This is a common assertion, but it fails to recognise the potential of data protection regulatory regimes to reach the parts other laws cannot — and perhaps more effectively. See Wacks R, ‘Is the Private Domain Doomed?’ in Wacks R, The Moral Dimension of Law: Justice, Rights and the Private Domain Hong Kong University Press, Hong Kong, forthcoming.

[14] See Wacks R, Personal Information: Privacy and the Law, Clarendon Press, Oxford, 1993 Chapter 3; Wacks R, Privacy and Press Freedom, Blackstone Press, London, 1995 Chapter 5.

[15] I draw here on Wacks R, Privacy and Press Freedom, above note 14. There is much, I think, in the approach adopted by Hill A, ‘Defamation and Privacy under the First Amendment’ (1976) 76 Columbia Law Review 1205; note also ‘The Right of the Press to Gather Information’ (1971) 71 Columbia Law Review 838. In Dietemann v Time Inc 449 F 2d 244 (9th Cir 197) two reporters of Life magazine tricked the plaintiff into allowing them access to his home and there set up hidden surveillance devices to monitor the plaintiff, a virtually uneducated plumber, who purported to diagnose and treat physical ailments. The resulting article informed the public about a newsworthy topic — the unlicensed practice of medicine — but the court had to consider whether this would grant immunity to the reporters in respect of their surreptitious news gathering techniques. On appeal, the judgment in the plaintiff’s favour for invasion of privacy was upheld. In answer to the defendant’s claim that the First Amendment’s shield extended not only to publication but to investigation, the court remarked that the amendment ‘has never been construed to accord newsmen immunity from torts or crimes committed during the course of newsgathering’ (at 249). It added that ‘there is no First Amendment interest in protecting news media from calculated misdeeds [thus] damages for intrusion [may] be enhanced by the fact of later publication’ (at 250).

[16] [1968] USCADC 534; 410 F 2d 701 (DC Cir), cert denied, 395 US 947 (1969).

[17] Hill, above note 15, 1380.

[18] See Barber v Time Inc 348 Mo 1199; 159 SW 2d 291 (1942) where the plaintiff, a woman with a serious eating disorder, was surreptitiously photographed in hospital by a newspaper reporter, and the picture was published by the defendant.

[19] See Wacks R, above note 13.

[20] Though DPP 3 does, as stated in the text, somersault back to DPP 1. Moreover, if, as the court held, there was no act of data collection, DPP 3 could not come into play.

[21] While a relevant factor, the motives of the photographer should not determine whether the photograph is an act of data collection. This seems to be the consequence of Ribiero JA’s dictum: ‘It should be stressed that the fact that the photograph, when published, is capable of conveying the identity of its subject to a reader who happens to be acquainted with that person, just as the complainant’s teasing colleagues were able to identify her from the picture in the magazine, does not make the act of taking the photograph an act of data collection if the photographer and his principals were acting without knowing or being at all interested in ascertaining the identity of the person being photographed’ (at 14).

[22] At 11-12.

AustLII: Copyright Policy | Disclaimers | Privacy Policy | Feedback