In a chilling decision for media freedom in HK, the AAB has rejected our appeal of the Privacy Commissioner's order to remove from Webb-site Reports information obtained from published judgments, ruling that "reporting and publication for general use" is not an allowed purpose. Constitutional aspects, such as the necessity of a restriction on free speech that does not apply to overseas online publishers, were barely covered. We look at the consequences and options.

AAB rejects Webb-site appeal of redaction order
30 October 2015

Late last night, Webb-site Reports learned that the Administrative Appeals Board (AAB) has dismissed our editor, David Webb's appeal against an Enforcement Notice issued by the Privacy Commissioner for Personal Data (PCPD).

The Enforcement Notice required us to redact our reports linking to three judgments handed down in 2001 and 2002 by the Court of Appeal and Court of Final Appeal after open hearings. The information we reported was collected from the judgments, and the judiciary, some 10 years after publication, redacted the copies on its web site to remove the names of the parties and persons involved. The Decision leaves us (and anyone else who collected it) in possession of legally-published information that we cannot provide to others. Pending the outcome of the appeal, we had already censored our reports (although the Complainant subsequently withdrew her complaint), so that will remain the case while the Decision stands.

The AAB did not have the courtesy to e-mail the Decision to us, and the first we heard was when a journalist contacted us for comment on the decision. The journalist had been told where to find it on the PCPD server, although it was not then publicly visible. This morning a media release dated yesterday has appeared with the Decision on the PCPD web site.

The Decision, while it stands, will have a chilling effect on the freedom of the media in Hong Kong. The Decision draws a distinction without a difference between our case and a case heard in 2007 (AAB 36/2007, Tung Lai Lam v PCPD, English, Chinese). In that case, the AAB decided that the relevant original "purpose" when a member of the media reports a court document (in that case, a writ reported by Ming Pao newspaper) is the purpose of the newspaper, and if their purpose of reporting and publication does not change, then they are not in breach of Data Protection Principle 3, which requires that personal data shall not (without consent of the data subject) be used except for the purpose at the time that the data was collected, or a directly related purpose.

At paragraph 32 of the current Decision, the AAB, chaired on this occasion by Eugene Fung Ting Sek SC with lay members Hattie Cheng Kin Hei and Cheung Chor Yung, states:

"We do not believe the Appellant's purpose of using the Complainant's personal data (i.e. reporting and publication for general use) can be said to be consistent with the Judiciary's purposes of publishing the judgments...in other words, the Appellant used the relevant personal data for a "new purpose" within the meaning of DPP3."

So now the AAB thinks that it is the purpose of the data source (the judiciary) that matters, not the purpose of the data collector (the media), and that the judiciary's purposes are not consistent with "reporting and publication for general use". The clear implication is that, if the media reports the contents of court judgments or writs (available offline from the court registry), relating to living humans and without their consent, then the media's "reporting and publication for general use" will be in breach of DPP3 and they will be subject to potential enforcement action by the PCPD, requiring their reports to be removed from public view. We see no distinction in principle between linking to a judgment (a short form of report) versus repeating its contents in an article (as we sometimes do), with or without links to the judgments.

This will deter media coverage of writs and judgments, or at least will mean that media will have to run take-down departments to deal with requests for removal of embarrassing public domain information, and if they cannot afford to run take-down departments, then they will remove their archives from public view. The media can now expect an avalanche of such requests and complaints to the PCPD from people who consider that online embarrassing information on their past drunk-driving convictions, former bankruptcy, matrimonial disputes, personal litigation or disputes over inheritance is personal data that the media should not have reported or should no longer retain.

The Decision establishes an ECJ-style "Right to be forgotten" and removes a "Right to remember and repeat" without any proper legislation. In our submission, the Personal Data Privacy Ordinance (PDPO) was intended to keep private data private, not to make public data private. Watch as Orwellian memory holes appear, and those who know the missing information cannot tell those who don't.

The AAB has placed the PCPD squarely in the role of media watchdog. The PCPD will carry out a "balancing exercise" and decide whether to require take-down, based on its own perception of whether the information is of public interest and even whether the publisher normally covers these areas. As today's PCPD media release states, the PCPD takes into account what it says are the purposes of the publisher - apparently the PCPD believes that Webb-site Reports should be restricted to certain areas and that our reports of the judgments:

"did not serve to promote the transparency of operations of companies, governments, regulators and controlling shareholders; nor was it able to achieve the purpose of condemning public vices or protecting the minority shareholders’ interest. In the circumstances, the balance should be tipped in favour of protecting the Complainant’s personal data"

Perhaps if we had a stated objective of being a tabloid gossip site then the balance would have been "tipped" in our favour. Just where does the PCPD draw its authority to decide what areas a publisher can cover? Our actual coverage, as long-time readers will know, is far wider than they say anyway.

The AAB appears to take the view, in paragraph 30(3), that the "purpose" of publication of judgments is solely for law reports and legal analysis - but in that case, why are they available to the general public online? What is the judiciary's "purpose"? Perhaps the most authoritative word on this comes from the Chief Justice at the time that the judiciary decided to put judgments online, Andrew Li Kwok Nang, who said in a speech on 10-Dec-2001:

"Justice needs to be done and justice needs to be seen to be done. Open justice is a fundamental feature of our system. Court lists are readily accessible from the Judiciary website. To maintain and strengthen public confidence, it is important that the public has easy and convenient access to judgments of the courts. For this purpose, we have made court judgments available on our website and both local and overseas viewers now have easy access to them."

The Decision barely contemplates the issue of whether the implied restriction on freedom of speech and expression contained in the Basic Law (Article 27) and Bill of Rights (Article 16(2)) is constitutional. A restriction on a constitutional freedom must be "necessary" to protect another right, and to be necessary, it must pass a "proportionality test". In layman's terms this means that the restriction must substantially achieve its goal (in this case, to protect privacy) and do no more harm to the freedom than is necessary. We pointed out that HK's public domain information is freely available on the internet and can be collected from overseas and published overseas, and that HK residents can access it by visiting overseas web sites, or if the HK Government erects a firewall around HK like China has, then by tunneling underneath it with a Virtual Private Network. Therefore the restriction cannot achieve its objective, harms HK-based publishers and is void for lack of constitutional necessity.

The AAB dismissed the necessity test with an irrelevant reference to a "balancing exercise" to be carried out by the PCPD in enforcement, ignoring the fact that no such exercise can be carried out against publishers outside HK territorial jurisdiction, particularly if the publisher is in a country where the activity is legal, as in Singapore, where there is an exemption for publicly available data (see PDF pages 17-21), or the USA, where there is no such privacy law and they have constitutional freedom of speech.

Ironically, the Decision implies that if the media report our editor's name in relation to the contents without his consent, then they may be breaching DPP3. The PCPD has slapped a red warning box to this effect on the top of the Decision, as it does with all such documents. We disagree. It is a public document and in our view, you don't need our consent.

So what now? We will of course consider these and other grounds for judicial review of the Decision, but this is not just a question of whether we would win, but whether we can justify spending further time and effort in years of court proceedings, relative to the good we can do in other areas. One option is to step aside and hope that larger media organisations with more resources will take the PCPD to the courts when it issues an Enforcement Notice and the AAB rejects their appeal. Another option is to spend time lobbying for a legislative amendment to explicitly exempt legally-published public domain data from the PDPO, as Singapore has, and put the question beyond doubt.

We have at least gone further than the people behind the famous Do-No-Evil app (who did not appeal to the AAB), but whether we now step forward or aside depends partly on the willingness of those in the legal community to do some heavy lifting for the public good - we were never in this for money or personal gain, but to try to preserve one of HK's most important freedoms.

© Webb-site.com, 2015

Organisations in this story

People in this story

Topics in this story

Sign up for our free newsletter

Recommend Webb-site to a friend

Copyright & disclaimer, Privacy policy

Back to top