Personal Data (Privacy) Ordinance (“PDPO”) – Hong Kong Law Does Not Provide a Right to Be Forgotten!

On 2nd July 2014, the Police arrested a number of persons for participating in an unauthorised assembly and obstructing police officers (“the Incident”).

The Incident attracted wide publicity. 

A person participating in the Incident (“the Participant”) was arrested by the police on the basis of his illegal participation and his personal information (including his name posts held in official bodies) were published and can easily be searched on Google.

The Participant lodged a complaint (“the Complaint”) with the Personal Data Privacy Commissioner (“the Commissioner”) against Google requiring that Google delist the links enabling access to his personal information.

The PDPO applies to the Collection of Personal Data meaning any data relating directly or indirectly to a living individual, from which it is practicable for the identity of the individual to be directly or indirectly ascertained and in a form in which access to or processing of the data is practicable.  The Ordinance applies to activities of “data users” defined as persons controlling the collection, holding, processing or use of the data of a “data subject” which in relation to personal data means the individual who is the subject of the data.

Under the PDPO there are six data protection principles of which Principle 2 (“Principle 2”) requires that all practicable steps shall be taken to ensure that personal data is not kept longer than is necessary for the fulfilment of the purpose (including any directly related purpose) for which the data is or is to be used.

s.39(2)(d) of the PDPO provides that the Commissioner may decide to terminate his investigation where he may refuse to carry out or decide to terminate an investigation if he is of the opinion that, having regard to all the circumstances of the case, there was no prima facie evidence of any contravention of the requirements under the Ordinance.

The Participant appealed against this decision to the Administrative Appeals Board (“AAB”) established under the PDPO to hear appeals from decisions of the Commissioner.

The AAB has handed down its written decision made on the hearing on 7th and 8th May 2020.

There are two principal issues regarding the PDPO in this Complaint.

1.           Issue 1 - Jurisdiction

In the original appeal the Participant had included two legal entities as the subject of complaint.  The first was Google LLC a legal entity which lies outside the territorial jurisdiction of the PDPO in Hong Kong.  The second was Google HK, a company incorporated in Hong Kong.

The AAB found that the Commissioner had been correct in finding that :-

(i)          Google HK although being a subsidiary of Google LLC is a different legal entity from Google LLC and that,

(ii)         Accordingly, the function of Google HK is only to serve to provide marketing and support of Hong Kong businesses.

(iii)        Conversely, Google LLC clearly established that all its operations in relation to the internet search engine were performed outside Hong Kong and Google LLC simply had no presence in Hong Kong.

(iv)        The Participant produced no contrary evidence to contradict this factual finding simply submitting that the domain name of “Google.com.hk” is registered by Google HK and, accordingly, Google HK should have control over the subject data.

(v)         The AAB found that there is no merit in this contention which is not supported by any evidence.  The domain of “Google.com.hk” has nothing to do with the identity of the person who controls the operation of the search engine which was performed by Google LLC operating the search engine outside of Hong Kong.

Accordingly, the Board agreed with the Commissioner as the Respondent in the appeal that :-

(a)          the PDPO does not apply to a foreign person or entity who has no operation controlled within or from Hong Kong since the PDPO does not have extra territorial effect;

(b)         as a matter of fact, Google LLC is not situated in and does not have any operations in Hong Kong;

(c)          the jurisdiction and power of the Commissioner are limited and do not extend to regulate and control the conduct of a foreign body such as Google LLC whose operations are not controlled within or from Hong Kong and the PDPO is a law enacted in Hong Kong applicable to (inter alia) personal data relating to data users in Hong Kong and data subjects in Hong Kong – all being within the Hong Kong jurisdiction.

(d)     hence, Google LLC does not fall within the scope of “data user” under the PDPO.

The above consideration relates to the availability, or not, of the right to be forgotten under the PDPO.

2.           Issue 2 – Right to be Forgotten

2.1         Given that the operations of Google LLC all take place outside of Hong Kong and there is no collection of personal data on the website through the internet which is done physically in Hong Kong, there is no “collection of data” in Hong Kong nor for the same reason is there any processing or holding of data in Hong Kong.

2.2         However, although Google LLC is beyond the jurisdiction of the PDPO and the Commissioner, it does otherwise fall within the definition of data user because the data collected which can identify the data subjects is displayed in the search engine function of Google LLC and if the jurisdictional issue did not apply Google LLC would have been a data user under the PDPO.

2.3         Given that there is no Hong Kong jurisdiction under the PDPO the AAB brief addressed the legal issues of “the right to be forgotten” under the applicable provision of Principle 2 and Section 26(1) of the PDPO providing that “a data user must take all practicable steps to erase personal data held by the data user where the data is no longer required for the purpose (including any directly related purpose) for which the data was used unless :-

              (a)    any such erasure is prohibited under any law; or

              (b)    it is in the public interest (including historical interest) for the data not to be erased.

              Where data users are in Hong Kong jurisdiction this applies to them.

“The right to be forgotten” contains a concept which has meanings of its own which does not find its way into the PDPO.  Accordingly, the burden of establishing in Hong Kong of success in importing such an independent right into the PDPO is a very heavy one and the AAB is of the view that there is no such independent right in Hong Kong.