Clsa Premium Ltd (Formerly Known As Kvb Kunlun Financial Group Ltd) and Others v. Banclogix System Co., Ltd

HCA 1416/2019

[2021] HKCFI 1102

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

ACTION NO 1416 OF 2019

________________________

________________________

Before: Hon G Lam J in Chambers

Date of Hearing: 10 February 2021

Date of Decision: 23 April 2021

_________________

DECISION

_________________

Introduction

1.The plaintiffs are members of a group of companies that carry on the business of providing financial services.  The defendant is a company that provides IT services. 

2.Since 2014, the defendant had from time to time provided IT services to the plaintiffs group.  The plaintiffs allege that in late July and early August 2019, the defendant obstructed or denied the 1^st plaintiff’s requests for access to the plaintiffs’ data in the custody of the defendant and took steps to delete or tamper with the plaintiffs’ data.  On 5 August 2019, the 1^st plaintiff issued the action herein and obtained ex parte from DHCJ Maurellet SC an injunction against the defendant to prohibit any deletion or disposal of the plaintiffs’ data or destruction of back‑up copies (“Ex Parte Order”). An inter partes summons for continuation of the Ex Parte Order was issued by the 1^st plaintiff the next day, returnable on 9 August 2019. 

3.On the return date, the defendant gave certain undertakings (“Undertakings”) pending the determination of the 1^st plaintiff’s summons, which was adjourned for substantive hearing.  On 9 September 2020, the defendant issued a summons for the discharge or variation of the Undertakings and for fortification of the 1^st plaintiff’s cross‑undertaking as to damages.  Both summonses were heard before me at the same time on 10 February 2021.

4.On 4 November 2020, leave was given for the 2^nd, 3^rd and 4^th plaintiffs to be added and for the statement of claim to be amended. The action has been ordered to be tried together with a related action, HCA 452/2020.

Background

5.The 1^st plaintiff carries on the business of providing financial investment services, and specialises in the provision of leveraged forex trading services.  The 2^nd to 4^th plaintiffs are its subsidiaries in Hong Kong, Australia, and New Zealand respectively, licensed to carry out regulated activities in their respective jurisdictions.  The 2^nd plaintiff holds a “Type 3 Licence” for foreign exchange trading in Hong Kong, and is regulated by the Securities and Futures Commission here (“SFC”).  The 3^rd plaintiff holds an “Australian Financial Service Licence”, and is regulated by the Australian Securities and Investments Commission.  The 4^th plaintiff holds a “Derivatives Issuer Licence” and a “Broking Service Licence” in New Zealand, and is regulated by the Financial Markets Authority there.

6.The 1^st plaintiff was listed on the Growth Enterprise Market of the Hong Kong Stock Exchange in June 2013.  Its listing was transferred to the Main Board in December 2017.  KVB Kunlun Holdings Ltd (“KVB Holdings”) used to be the majority shareholder of the 1^st plaintiff until May 2015, when it sold a 59.37% stake to CITIC Securities Co Ltd (“CITIC”), and was left holding 14.75% in the 1^st plaintiff. 

7.The defendant is a wholly‑owned Hong Kong subsidiary of KVB Holdings, engaged in the provision of IT services for customers in the financial services sector.  The defendant was thus a sister company of the 1^st plaintiff until May 2015.  Despite the sale of a majority stake to CITIC as mentioned above, the management of the 1^st plaintiff’s group, headed by its CEO Mr Stefan Liu (“Liu”), was not fundamentally changed until mid‑2019 in circumstances referred to below.  Liu is also a director of KVB Holdings.

8.In around 2014, the 1^st plaintiff and the defendant entered into an agreement whereby the defendant would provide IT services to the 1^st plaintiff and its subsidiaries.  The agreement had since been renewed several times.  The present dispute arises from the latest version of the agreement (“IT Services Agreement”) executed on 28 December 2018.  It is governed by, and to be construed under, Hong Kong laws (clause 12.1).

9.Pursuant to the IT Services Agreement, the defendant shall provide specified IT services to the 1^st plaintiff’s group in the ordinary course of their business as financial service providers (clause 3.1), in exchange for fees (clause 3.2).  These services fall into 4 categories: (i) software development services, (ii) software maintenance services, (iii) IT infrastructure project management services, and (iv) IT infrastructure maintenance services (clause 1, “Services”).  The precise ambit of the services (“Services”) are set out in the schedules to the IT Services Agreement.

10.In the course of the provision of services to the 1^st plaintiff’s group, the defendant had developed and supplied 3 key products (collectively, “Key Systems”), namely:

(1)  the ForexStar Trading System (“Trading System”) — a live margin forex trading platform whereby the investing public may execute trades of foreign currencies with the 1^st plaintiff;

(2)  the client relationship management system (“CRM System”) — an internal platform primarily used by the 1^st plaintiff to keep and maintain customer records and customised by the defendant to suit the 1^st plaintiff’s needs; and

(3)  a system known as “System Application and Products in Data Processing” (“SAP System”) — a German business software package which provides enterprise‑wide resource planning solutions designed to integrate all areas of a business (such as financial accounting and human resources).

11.The plaintiffs say that during the course of the IT Services Agreement (and its predecessors), information, data, electronic files or documents relating to their business had come into existence, including emails sent to or from the plaintiffs, information regarding transactions and customer information, and reports and summaries generated by the system based on the primary data.  They have been called “the Plaintiffs’ Data”, the scope and meaning of which have been the subject matter of debate which I shall describe later.

12.In late June 2019, CITIC became aware of allegations that Liu had established entities outside of the 1^st plaintiff’s group and arranged to redirect certain core assets including customer accounts, IT server and confidential information to those entities.  As a result, CITIC obtained majority control on the 1^st plaintiff’s Board of Directors at its AGM on 27 June 2019.  On 23 July 2019, CITIC seconded 4 staff members from CLSA Hong Kong Holdings Ltd (a subsidiary of CITIC) to assist in the management of the 1^st plaintiff.  The 1^st plaintiff alleges that when those seconded staff members attempted to gain access to its data in its office, they were repeatedly obstructed by the 1^st plaintiff’s then employees who reported to Liu.  The 1^st plaintiff’s Board decided to remove Liu but he resigned on 28 July 2019.

13.The 1^st plaintiff alleges that its requests in the following few days to obtain access to its data were obstructed or unreasonably denied by the defendant. Further, it is alleged, on information said to have come from two whistleblowers among the staff, that the defendant had taken steps to delete or tamper with the Plaintiffs’ Data.  The allegations include (i) that since the beginning of 2019, most of the file and email servers containing the Plaintiffs’ Data had been moved from Hong Kong to Singapore; (ii) that Tony Yang, a senior officer of the 1^st plaintiff until 2 August 2019, had deleted data from the file server; (iii) that Tony Yang had asked an employee to remove the back-up tapes of the file server of the plaintiffs’ group from the 1^st plaintiff’s office to the defendant’s premises; (iv) that the defendant’s Chief Information Officer (“CIO”) had instructed the whistleblowers to delete certain data in the CRM System of the plaintiffs’ group (though they declined to do so); and (v) that the mailboxes of certain important ex‑employees of the plaintiffs’ group might have been deleted.

14.The defendant denies that there was any diversion of business or plan to do so or any step taken to obstruct access to the Plaintiffs’ Data.  It is unnecessary for present purposes to enter into the detailed allegations and explanations raised by both sides, for it is sensibly accepted that those factual allegations cannot be resolved one way or the other simply on written evidence, and nothing relevant to the present summonses requires me to determine those allegations, a matter which must be reserved for trial.

15.As a consequence of the events in June, July and early August 2019, the 1^st plaintiff issued proceedings and obtained ex parte an interlocutory injunction to restrain the defendant from deleting or disposing of the Plaintiffs’ Data and from destroying or disposing of any back‑up tapes or other back‑up storage media containing the Plaintiffs’ Data, until 9 August 2019.  As mentioned above, on the return date, the defendant gave the Undertakings pending the substantive determination of the 1^st plaintiff’s summons, which read as follows:

“ AND UPON THE UNDERTAKING GIVEN BY THE DEFENDANT that until the substantive determination of the Plaintiff’s Summons or until further order of the Court, unless with the Plaintiff’s prior consent in writing, the Defendant undertakes not to, directly or indirectly, whether through its directors, officers, employees, agents, and whether inside or outside Hong Kong, delete or dispose of any data owned by the Plaintiff’s Group (as defined in paragraph 4(a) of the Ex Parte Order), or supplied by or originated from the Plaintiff’s Group and/or their customers in connection with any services provided by the Defendant to the Plaintiff’s Group under the IT Services Agreement in relation to the Provision of Information Technology Services dated 28 December 2018 entered into between the Plaintiff and the Defendant, and contained or hosted on computer servers, back‑up tapes or any other media in the Defendant’s possession, custody or power whether inside or outside Hong Kong (the ‘Plaintiff’s Data’), SAVE AND EXCEPT such deletion and/or modification in the ordinary course of business and/or for proper system maintenance

AND UPON THE UNDERTAKING GIVEN BY THE DEFENDANT that until the substantive determination of the Plaintiff’s Summons or until further order of the Court, the Defendant shall preserve (and shall not, directly or indirectly, whether through its directors, officers, employees, agents, and whether inside or outside Hong Kong, damage, delete, modify, destroy or dispose of) any and all of the annual back‑ups referred to in paragraph 43(c) of the Ye Affirmation, rotational back‑up version referred to in paragraph 43(b) of the Ye Affirmation containing the Plaintiff’s Data as at 26 July 2019 (or, if not available, the next available day) and non‑rotational back‑ups (if any) containing the Plaintiff’s Data”

Paragraph 4(a) of the Ex Parte Order, referred to in the Undertakings, stated that the “Plaintiff’s Group” means the 1^st plaintiff and its subsidiaries listed in Schedule 3 to the Ex Parte Order, which include, amongst others, the 3 companies that had since become the 2^nd to 4^th plaintiffs in this action.

16.Two main differences between the terms of the Ex Parte Order and the Undertakings are that (i) the Undertakings contain an “ordinary course of business” exception for the defendant’s benefit and (ii) the Ex Parte Order covered not only any data owned by the plaintiffs but also any data “relating to the Plaintiff’s Group or the business of the Plaintiff’s Group”. 

17.On 26 August 2019, the defendant afforded the plaintiffs’ group a certain level of rights and access to the Plaintiffs’ Data, and has since been disabled from certain administrative rights itself.  What is in dispute however is the degree of the rights and access which the plaintiffs’ group and the defendant now respectively have. Essentially, the plaintiffs claim that there are certain data to which they still have no access (such as that in a server named “HitHKFS01”), and that the defendant retains residual rights to access the Plaintiffs’ Data.  On the other hand, the defendant claims that it no longer has any right or access to the Plaintiffs’ Data, and that the plaintiffs now have “full administrative rights” over the same.

18.On 19 March 2020, the 1^st plaintiff gave notice, purporting to terminate the IT Services Agreement with immediate effect.  On 6 April 2020, the defendant claimed that the 1^st plaintiff had committed a repudiatory breach, and purported to accept the repudiation and terminate the IT Services Agreement.  These events culminated in another High Court action (HCA 452/2020) brought by the defendant herein against the 1^st plaintiff herein for relief for wrongful repudiation of the IT Services Agreement.  For present purposes, therefore, both parties have proceeded on the basis that the IT Services Agreement has been terminated.

The parties’ pleaded cases

19.Against this background, and so far as material to the present summonses, the plaintiffs’ pleaded case in the Amended Statement of Claim dated 5 November 2020 may be summarised as follows:

(1)  By reason of business efficacy (particularly the 2^nd to 4^th plaintiffs’ various regulatory and statutory requirements of record‑keeping and provision of access to information), there are the following implied terms in the IT Services Agreement (collectively, “Ps’ Implied Terms”):

(a)  The defendant shall, on the plaintiffs’ demand, provide to the plaintiffs full and unrestricted access to all of “Plaintiffs’ Data” which were and are kept, hosted and/or stored on various “Storage Devices” (eg databases, servers and back-up tapes) that were and are kept and/or maintained by the defendant on the plaintiffs’ group’s behalf for the purposes of the IT Services Agreement (“Duty to Provide Access”);

(b)  Without the prior consent of the plaintiffs, the defendant shall maintain and shall not delete or dispose of any of the “Plaintiffs’ Data” kept, hosted and/or stored on the Storage Devices (“Duty Not to Delete”);

(c)  For all such “Plaintiffs’ Data” stored, hosted and/or kept by the defendant on the Storage Devices, the defendant shall keep and maintain reasonable back‑up files or tapes, and such back‑up files or tapes shall be the property of the plaintiffs and/or the plaintiffs’ group (“Duty to Keep Back-up”); and

(d)  The defendant shall, on the plaintiffs’ demand, deliver and/or provide copies of the relevant Plaintiffs’ Data to the plaintiffs (“Duty to Deliver”).

(2)  The “Plaintiffs’ Data” is defined in the pleadings in somewhat different terms from the definition in the Undertakings. For present purposes, it seems to me one needs only to focus on the following pleaded category, as this is the one relevant to the Undertakings:

“ 12. For the purpose of the present action, the ‘Plaintiffs’ Data’ means the following, whether located inside or outside Hong Kong and which came into existence during the pendency of the Previous Agreements and the IT Services Agreement:

12.1 All information, data, electronic files (including text or audio) or documents supplied or transmitted by or through or originated from the 1^st Plaintiff and/or the Plaintiffs’ Group and/or their clients to the Defendant for hosting on the ‘Storage Devices’ created, owned or maintained by the Defendant, and any copies made by the Defendant.”

(3)  The defendant was (and remains) in breach of:

(a)  the Duty to Provide Access and the Duty to Deliver, by failing and/or refusing to grant access and/or provide a complete copy to the 1^st plaintiff in relation to the Plaintiffs’ Data kept on the defendant’s Storage Devices;

(b)  the Duty Not to Delete, by deleting or attempting to delete the Plaintiffs’ Data kept on the defendant’s Storage Devices, including back‑up tapes; and

(c)  the Duty to Keep Back‑up, by claiming that it was under no duty to keep any back‑up of the Plaintiffs’ Data.

(4)  The plaintiffs claim, inter alia, relief as follows:

(a)  a final injunction that the defendant shall not (i) delete, modify or dispose of the “Plaintiffs’ Data”; or (ii) damage, delete, modify, destroy, or dispose of any back‑up tapes or any other back‑up storage media which contain the “Plaintiffs’ Data”;

(b)  a final injunction that the defendant shall provide the plaintiffs with unrestricted access to all of the “Plaintiffs’ Data” and permit them to make a complete copy.

20.So far as material for present purposes, the defendant’s pleaded defence is as follows:

(1)  The defendant denies or explains the various steps or acts that the plaintiffs accuse it of having committed in obstructing access or removing or destroying data.

(2)  The defendant does not admit the existence of any of Ps’ Implied Terms.

(3)  Further, it is denied that the defendant is or was under any duties imported by any of Ps’ Implied Terms, or that the defendant has ever breached any such duties.

(4)  The IT Services Agreement contained implied terms, among others, that the defendant is not obliged to render any performance that would amount to a contravention of the laws or regulations of Hong Kong or other jurisdictions.

(5)  Whilst the 1^st plaintiff may have access to data “which are available and accessible in the ordinary and normal use of the Key Systems” and which are “available on the Key Systems at the prevailing time (or at the time when access is made)”, the defendant is under no duty to afford the 1^st plaintiff access to “historical data” or to deliver copies of any electronic files or documents thereof.

(6)  P’s Implied Terms could expose the defendant (and/or its subsidiaries, officers and/or staff members) to potential breaches of foreign laws and regulations (including data privacy laws).

(7)  The definition of the “Plaintiff’s Data” in the plaintiffs’ pleadings is “uncertain, unclear and/or unduly wide”, and should not cover information sourced by the defendant and provided by third parties, or historical data generated by the Key Systems.

The parties’ positions on the summonses

21.Although the 2^nd to 4^th plaintiffs have been joined into the action, the 1^st plaintiff’s summons has not been amended to include them as applicants and therefore remains the 1^st plaintiff’s application alone, albeit supported by the other plaintiffs.  The summons on its face seeks an order that the ex parte orders made on 5 August 2019 be continued until further order.  This is no longer apposite since the ex parte injunction had long expired, having been replaced by the Undertakings.  Mr Vincent Lung, who appeared on behalf of the plaintiffs, indicated that the plaintiffs actually seek an injunction in terms of the Undertakings until trial. 

22.Those Undertakings were given pending the substantive hearing of the 1^st plaintiff’s summons and, therefore, as I indicated and Mr Lung accepted at the hearing, it is incumbent upon the 1^st plaintiff to persuade the court that an injunction should issue.  In so far as the plaintiffs suggested in their written submissions that an injunction should be granted unless the defendant established that its Undertakings ought to be discharged pursuant to its summons, that submission is incorrect.

23.Since the Undertakings will on their own terms come to an end upon the determination of the 1^st plaintiff’s summons, the defendant’s summons in so far as it seeks the discharge of the Undertakings had become redundant once it was fixed to be heard with the 1^st plaintiff’s summons.  At the hearing, Mr Yuen SC, who appeared on behalf of the defendant, indicated that, if the court is minded to grant an interlocutory injunction as sought by the 1^st plaintiff, the defendant would again prefer for the Undertakings to continue.  The question for me is therefore whether injunctive relief in terms now sought should in principle be granted.

24.Separately, the defendant by its summons also seeks fortification of the 1^st plaintiff’s cross‑undertaking as to damages by payment into court of a sum to be decided by the court.  The 1^st plaintiff submits that no fortification should be ordered.

25.In deciding whether the injunction sought should be granted, there is no dispute that the court has to consider (i) whether there are serious issues to be tried, (ii) whether damages would be an adequate remedy for either side, and (iii) if damages would be inadequate for both sides, where the balance of convenience lies in terms of whether or not to grant the injunction pending the trial of the action.

26.By way of an overview, the defendant opposes injunctive relief on the following grounds:

(a)  There is no serious issue to be tried because the plaintiffs’ claims are premised on the plaintiffs being the owner of the Plaintiffs’ Data, but the IT Services Agreement clearly allocates ownership of such data to the defendant; and the Implied Terms could not possibly be imported.

(b)  There is no utility in continuing injunctive relief against the defendant, because (i) the defendant handed over full administrative rights to the 1^st plaintiff on 26 August 2019, and (ii) the IT Services Agreement has already come to an end.

(c)  The 1^st plaintiff was guilty of material non‑disclosure in the ex parte application.

27.I shall deal with these issues in turn below.

Serious issues to be tried

28.A serious issue to be tried is not a high hurdle.  An applicant has to demonstrate that the claim is not frivolous or vexatious.  The respondent seeking to argue there is no serious issue to be tried has effectively to show that the claim should be struck out: Yifung Properties Ltd v Manchester Securities Corp (unrep, CACV 258/2015, 9 September 2016), §§19‑20.  Although there are multiple substantive claims and issues, given that the interlocutory injunction applied for relates to the final prohibitory injunction sought, it is the merits of that claim that are of significance.

29.The first point taken by Mr Yuen for the defendant is that the plaintiffs’ proposition that the Plaintiffs’ Data is owned by or otherwise belongs to them is untenable because the IT Services Agreement, by clauses 1.1 and 5.1, expressly allocates the ownership of the Plaintiffs’ Data to the defendant through the concept of “database right”.

30.Clause 5 of the IT Services Agreement provides:

“ 5.1 [The 1^st plaintiff] acknowledges and agrees that [the defendant] is the sole and exclusive owner of all Intellectual Property Rights arising from or in connection with the Services.

5.2    Nothing in this agreement or otherwise grants to [the 1^st plaintiff] or any member of the [1^st plaintiff’s group] any Intellectual Property Rights in any of the Services.”

31.Clause 1.1 defines “Intellectual Property Rights” as:

“ … any and all intellectual property rights including (but not limited to) all of the following, and all rights in, arising out of, or associated therewith (in each case, whether registered or not); (i) patents; (ii) know‑how, trade secrets, ideas, concepts, inventions, discoveries, developments, devices, methods and processes (in each case, whether or not patentable); (iii) trademarks, service marks, business names and trade names; (iv) rights in any designs; (v) copyright, software, source codes, object codes, specifications and other works of authorship, databases and database rights; (vi) any and all other intellectual property rights, and related documentation with respect to all of the foregoing; (vii) any and all registrations of, or applications to register, or any rights to register or apply to register, any of the foregoing; and/or (viii) any similar or analogous rights anywhere in the world …” (emphasis added)

32.In connection with the concept of “database rights”, Mr Yuen refers to the Copyright and Rights in Database Regulations 1997 of the United Kingdom, including a provision that “a person infringes database right in a database if, without the consent of the owner of the right, he extracts or re‑utilises all or a substantial part of the contents of the database” (see regulation 16).

33.I doubt that a foreign statutory regulation is of assistance in the present context.  The meaning of “database rights” is to be found in accordance with the ordinary principles of contractual interpretation.  It is not suggested that the term has any fixed meaning at common law, and there is no statutory definition for it in Hong Kong law which governs the IT Services Agreement.

34.Looking at the matter unaided by any established meaning in the industry, it seems to me there may be a difference between rights to the data and database rights.  The distinction between the medium on which data is held and the data itself has been recognised in the cases: see, e.g., Your Reponse Ltd v Datateam Business Media Ltd [2014] EWCA Civ 281, §20.  Database rights are placed in clause 1.1 in the same category as “copyright, software, source codes, object codes, specifications and other works of authorship”, which as a class seem to me to contain the intellectual fruits of the creator of the relevant system.  It is in my view arguable that the information inputted into the Key Systems in the course of their usage by the plaintiffs, which was generated by the plaintiffs or their customers, did not constitute an intellectual property right of the defendant.  I do not think that the defendant has established beyond argument that the Plaintiffs’ Data falls within “database rights” and is thus owned by the defendant exclusively.

35.A related, but somewhat contradictory, argument raised by the defendant is that data or information is not property capable of being owned.  This is not easy to square with the above submission that the Plaintiffs’ Data falls within database rights which are owned exclusively by the defendant.  Anyhow, it is in my view unnecessary to enter into the controversial jurisprudential question of whether information qualifies as property, for it seems to me the real issue is who, as between the plaintiffs and the defendant, has dominion or perhaps some lesser rights of control (and if so, what rights) over the relevant data in the context of the IT Services Agreement and their post‑contract relationship.  Although the terms “own” and “belong” have been used liberally in the plaintiffs’ case, ownership strictly so called as a juridical concept is in my view not pivotal to the outcome of this case, for the claim is being made directly against the defendant in personam based on various duties said to have arisen from a contract between the defendant and the 1^st plaintiff.

36.The next point raised by the defendant is that there is no arguable case for Ps’ Implied Terms to be found to be part of the contract.  The principles on implying terms into a contract have been set out in Kensland Realty Ltd v Whale View Investment Ltd & another (2001) 4 HKCFAR 381 and Lo Yuk Sui v Fubon Bank (Hong Kong) Ltd [2019] HKCA 261 which I need not set out. 

37.The defendant’s first line of attack is predicated on a conflict between, on the one hand, the express terms of the IT Services Agreement (specifically, clauses 1.1 and 5.1 on the ownership of “database rights”), and, on the other, Ps’ Implied Terms insofar as they purport to impose duties that are “unrestricted in scope”, entitle the plaintiffs to access to the Plaintiffs’ Data “on demand”, and confer on the plaintiffs ownership of the Plaintiffs’ Data and the back-up files and tapes.  In light of my conclusion above, there is in my view a serious issue to be tried as to whether there is truly a conflict between the express terms and Ps’ Implied Terms.

38.The second line of attack essentially questions whether the plaintiffs could ultimately meet the stringent requirements for the implication of terms in fact.  The issue is ultimately one that would be decided by the trial judge.  On the present state of the pleadings, there is in my view a credible basis on which Ps’ Implied Terms could arguably be imported, in particular, the regulatory requirements of the 2^nd to 4^th plaintiffs.  I am not persuaded that the plaintiffs’ case is vexatious or frivolous on this front.

39.The third line of attack is similar to the point on ownership above and essentially questions whether the Plaintiffs’ Data can be owned as property as envisaged in Ps’ Implied Terms.  As explained above, I think this argument misses the point. The relief sought does not turn on any principles peculiar to property law, such as whether a lien could attach to an electronic database (which was the question with which the court in Your Response Ltd (supra) had to grapple).  For the purposes of this interlocutory application, the real focus is the Duty Not to Delete, which is a matter of personal obligation.  Whether the Plaintiffs’ Data constitutes property stricto sensu does not seem to me determinative of the issue.

Adequacy of damages and balance of convenience

40.Based on the evidence before me, I am satisfied that damages would be inadequate for the plaintiffs if injunctive relief is withheld, should their action prove to be well‑founded.  In particular, I accept that if the Plaintiffs’ Data is irretrievably deleted, the plaintiffs would suffer irreparable harm for which damages are inadequate.  A permanent loss of the data may seriously undermine the plaintiffs’ ongoing investigation and their ability to vindicate their rights against the defendant, Liu and related entities.  Further, deletion of the Plaintiffs’ Data may cause regulatory problems that are not remediable by money.  Whilst the details as to regulatory requirements set out in the plaintiffs’ pleadings have not been repeated in an affirmation, it is clear that the 2^nd to 4^th plaintiffs are licensed service providers which, one can readily infer, are subject to regulatory requirements on record‑keeping and provision of access to data.  The potential loss of goodwill, reputation or even the right to carry out licensed activities if the Plaintiffs’ Data is deleted cannot in my view be fairly recompensed by damages.

41.On the other hand, the additional expenses that the defendant says it will have to incur if the injunction is granted are small in amount, and could be reimbursed in damages if the injunction turned out to have been wrongly granted.  Mr Yuen submits that the defendant may also suffer reputational damage if an injunction is granted. I do not think this carries weight.  This would only be an interlocutory injunction, not declaratory of the final rights of the parties.  Nor does the court decide, for the purposes of this application, whether there has been any wrongdoing.  The parties with whom the defendant has dealings or potential dealings can reasonably be expected to understand the nature of the decision made herein if they happen to be aware of this decision.

42.I am satisfied that granting injunctive relief is the course that carries the lesser risk of injustice irremediable by an award of money should the court’s decision at this stage turn out to have been wrong.

Futility of continuing the restraint

43.The defendant submits that injunction being a discretionary remedy, the court should not make an injunctive order where it would be futile or serve no purpose.  There are two points raised in particular.

44.First, it is said that the defendant handed over “full administrative rights” over the 1^st plaintiff’s domain and file servers to the 1^st plaintiff on 26 August 2019 (and has itself since been disabled from such rights), so that it is no longer possible for the defendant to delete or dispose of the Plaintiffs’ Data.

45.There is, however, significant disagreement between the parties as to what rights the defendant has actually conferred on the 1^st plaintiff, and also as to what acts still lie within the defendant’s powers.  In my view, this is not a contest the court can finally adjudicate at this stage.  Of course, as submitted by Mr Yuen, the court should not be blind to the obvious.  But the subject matter of the disagreement is technical, and requires a detailed understanding of how data access in the respective systems works.  The phrase “administrative rights” has been used frequently in the materials, but it is not entirely clear what it precisely means in this context, including whether it is server‑specific, and if so, whether the defendant has given up (in favour of the plaintiffs) the administrative rights to all of the plaintiffs’ servers, and whether there can be a “backdoor” to reach the Plaintiffs’ Data even though the defendant is no longer an administrator.  

46.Mr Yuen took me to certain evidence which he said demonstrated (i) the 1^st plaintiff had in fact been granted “full administrative rights”, and (ii) the defendant’s administrative rights for the relevant servers had been suspended.  On close scrutiny, however, there remain uncertainties.  First, in the email exchange between Jimmy Lai (the plaintiffs’ Head of IT and Operations since 29 July 2019) and Stephon Ye (the defendant’s CIO) on 24 and 25 September 2019, Jimmy Lai had already noted that only limited administrative rights had been given to the 1^st plaintiff. Specifically, Jimmy Lai said “[t]he domain admin rights were given to kvbfg.com domain only but did not include the local admin rights to FG servers … ”, to which Stephon Ye replied “[w]e will clarify the local admin rights issue separately”.  It seems to me that, on the face of this exchange and the evidence in Mr Lai’s third affirmation dated 15 October 2020 about the local server “HitHKFS01”, it is not possible to determine conclusively here whether or not the 1^st plaintiff has been given access to all servers containing the Plaintiffs’ Data.

47.Further, I note that, in the various exchanges between the officers of the 1^st plaintiff and of the defendant that I have seen about the defendant’s administrative rights being disabled, the relevant rights related to the domain “KVBFG”.  There remains a concern as stated by Mr Lai in his third affirmation that the defendant might still be able to access and manipulate the Plaintiffs’ Data through user accounts of other domains.  I am unable to accept the defendant’s submission that it is beyond doubt that the defendant has since been wholly unable to access the Plaintiffs’ Data.

48.Secondly, the defendant argues that since the IT Services Agreement has come to an end, it would be wrong in principle to require the defendant to preserve something to which it does not even have access, and to require the defendant to continue to incur expenses for preserving the plaintiffs’ servers and network equipment.  Ultimately, I think this is a matter of practicalities rather than principle.  The plaintiffs’ contention that the Ps’ Implied Terms (so far as relevant for present purposes) survived the termination of the IT Services Agreement is in my view arguable. Any expenses that the defendant may turn out to have been wrongly required to incur can be fully reimbursed by a monetary order against the plaintiffs.

Material non‑disclosure

49.The principles governing an applicant’s duty to make full and frank disclosure in ex parte applications, and the consequences of material non‑disclosure, are settled and not in dispute between the parties, and need not be set out here.

50.The defendant submits that the 1^st plaintiff, in breach of its duty of full and frank disclosure, failed to disclose the following matters at the ex parte hearing:

(1)  that the IT Services Agreement provides that the defendant is the “sole and exclusive” owner of Intellectual Property Rights, and that the Plaintiffs’ Data prima facie falls within the concept of “database rights”, which is a specific legal concept that exists under English law;

(2)  the relevance and significance of the Segregation Exercise, which explains Tony Yang’s request for access to administrative accounts and his possible deletion of data;

(3)  that the deletion of data on the CRM System was conducted pursuant to the CRM Revamp Project which was expressly agreed to by the 1^st plaintiff (and which was thus within its knowledge);

(4)  that the defendant’s operations were at all material times (and still are) subject to the laws and regulations of different jurisdictions, including New Zealand privacy laws, under which the defendant would have potential legal liability if it were to supply the Plaintiffs’ Data to the plaintiffs;

(5)  other factual matters stated in §§158‑163 of the 2^nd affirmation of Stephon Ye, namely, the reasons and circumstances concerning Stefan Liu’s resignation; information about KVB Prime; and the fact that the operation of the Key Systems was not adversely affected by the defendant’s conduct which the 1^st plaintiff claimed to be wrongful. 

51.As to the first matter, the statutory concept of database rights in English law is, as stated above, not relevant for the purposes of the construction of a contract governed by Hong Kong law.  Further, as pointed out by the plaintiffs, the defendant’s solicitors had admitted, prior to the ex parte application, that any data of the 1^st plaintiff was “obviously its assets”: see email from Chiu & Partners dated 2 August 2019 which was referred to in the affirmation (and exhibited) for the ex parte hearing.  It would in my view be understandable even if the 1^st plaintiff did not anticipate that the defendant would turn around and argue that the Plaintiffs’ Data was the defendant’s property by virtue of the concept of “database rights” or otherwise.  In fact, the skeleton argument for the ex parte hearing (at §11.2) drew attention to clause 5 of the IT Services Agreement and the specific argument that the Plaintiffs’ Data might be said to be caught by “database” and “database rights”, and went on to set out the counter‑arguments.  There is in my opinion no substance in this complaint of non‑disclosure.

52.On the second matter, it is necessary first to set out the defendant’s explanation of certain conduct complained of by the plaintiffs.  The defendant says that:

(1)  There was a “Segregation Exercise” conceived back in 2015, when the SFC directed that the 1^st plaintiff stop sharing a domain with non‑listed entities.  At that time, the 1^st plaintiff and other subsidiaries of KVB Holdings (including non‑listed entities) had shared the same domain name (“KVB Kunlun” and “KVBKUNLUN.com” for email) and file server.  The Segregation Exercise began in earnest in March to April 2019, with the purpose of separating the 1^st plaintiff’s file server and domain from those of the non‑listed companies owned by KVB Holdings.

(2)  Before Tony Yang took over, Joanne Chiu (then Head of IT of the 1^st plaintiff) was in charge of the Segregation Exercise.  If it had transpired that materials belonging to the licensed entities under KVB Holdings still existed in the 1^st plaintiff’s servers, she would remove them.  After she was succeeded by Tony Yang in around May 2019, he became responsible for the conduct of the Segregation Exercise (including taking corrective steps).

(3)  Tony Yang’s requests for administrative rights were made for the Segregation Exercise.  The purpose was to allow him to check if any documents of the licensed subsidiaries of KVB Holdings still existed on the 1^st plaintiff’s share drives.  Insofar as any material was deleted, it only concerned those documents, the deletion was a corrective measure, and there would always be proper back‑ups.

53.There was limited disclosure of the existence of the Segregation Exercise at the ex parte stage.  The first affirmation of Jimmy Lai at §14(d) (and similarly the first affirmation of Yuan Feng at §§115‑116) stated that (i) the Plaintiffs’ Data in the file servers and email servers were originally mixed with the data belonging to companies outside of the 1^st plaintiff’s group (ie the defendant’s data), and that (ii) in or around April 2019, Tony Yang and Stefan Liu told Whistleblower 1 that they wanted to segregate the two classes of data so that the defendant’s data would not be accessible by the CITIC management when they took over the control of the 1^st plaintiff.  It was not disclosed that the Segregation Exercise was first conceived in 2015, when the SFC directed that the 1^st plaintiff use its own domain independently from non-listed entities in the defendant’s group.  

54.While the plaintiffs still dispute the motive or the “explanation” behind Tony Yang’s request for access to an administrative account (which would be a matter for trial), I consider the regulatory origin of the Segregation Exercise to be material, because it could have put a different light on the relevant acts of Tony Yang, and should have been placed before the ex parte judge.

55.The plaintiffs submit that there was an information asymmetry at the time of the ex parte application, as the new management had only recently taken charge of the 1^st plaintiff, and that they had disclosed all that was then known.  I am prepared to accept that the individuals involved in giving instructions and making the affirmations in question, being part of the new management, had no actual knowledge of the Segregation Exercise.  This does not, however, completely absolve the 1^st plaintiff, as it was under a duty to make proper inquiries before the ex parte application.  No submission has been made by the 1^st plaintiff to say that it would have been unrealistic for it to have looked into the possible reasons why Tony Yang and Stefan Liu would want to segregate the Plaintiffs’ Data from the defendant’s data.  This inquiry should have been made, since the 1^st plaintiff’s case was predicated in no small part on Tony Yang’s seemingly inexplicable request for access to administrator’s rights, and if made, would probably have led to the discovery of the Segregation Exercise.  It follows that there was a breach of the duty of full and frank disclosure in the sense discussed above.

56.Nevertheless, I do not consider such a breach (considered independently or together with other breaches, as to which see below) should cause the court to withhold injunctive relief.  I am satisfied that the non‑disclosure was not deliberate.  To withhold relief would in my judgment be disproportionate, and not comport with the interests of justice.

57.Turning to the third matter said to have been undisclosed to the ex parte judge, the defendant explains that to the extent that any CRM System data was deleted, such deletion was part of a planned upgrade of the CRM System (“CRM Revamp Project”) which was signed off as long ago as 7 August 2018 and was known to the 1^st plaintiff.  It was envisaged under the project that data would be deleted.  In particular, the old CRM System was expected to be completely deleted so as to free up the server after all pre‑existing data was migrated to the new system, and after the new system was found to be running in a stable fashion.  Further, any deleted data would have been backed up.  Accordingly, there was nothing improper for data in the CRM System to be deleted.  On 2 August 2019, Stephon Ye did speak with the defendant’s IT Managers as regards deleting data in the CRM System.  But that was only after Stephon Ye received an email stating that the new CRM System should be ready to go live on 19 August 2019.

58.The 1^st plaintiff seems to accept that the CRM Revamp Project was not disclosed at the ex parte stage.  It contends that the explanation given by the defendant for Stephon Ye’s request for deletion on 2 August 2019 is incredible.  I can see some force in the argument that the explanation is problematic because it is difficult to understand why one would begin to delete the old system before the new one was implemented and found to be operating smoothly.  Nevertheless, it seems to me it is something that should have been disclosed to the ex parte judge as a potential innocuous explanation for the deletion, together with such submissions as the 1^st plaintiff might be advised to make as to how incredible that explanation might be.

59.Again, informational asymmetry is not a complete answer because the 1^st plaintiff could, and in my view should, have made proper inquiries into possible explanations for the deletion or proposed deletion.  The CRM Revamp Project appears to have been well‑documented, with a statement of work intituled “Project Scope for Digital Marketing”, such that proper inquiries could have revealed the existence of the project to the 1^st plaintiff’s new management.  In this sense there was material non‑disclosure at the ex parte stage.

60.That said, for the same reasons in relation to the second matter above, I would not withhold injunctive relief on this basis, for I am satisfied that the non‑disclosure was innocent and not deliberate, there being nothing in the evidence to suggest that the 1^st plaintiff’s new management had actual knowledge of the CRM Revamp Project at the time.  I am also satisfied that requirements of justice weigh in favour the grant of an injunction.

61.As to the fourth matter raised by the defendant, I do not consider it to be material.  The only particularised basis of the complaint is that the defendant might be exposed to liability under the privacy laws of foreign jurisdictions if compelled to hand over the Plaintiffs’ Data to the plaintiffs.  Even assuming the opinion adduced by the defendant on New Zealand laws to be sound, it would not be material to the ex parte judge’s decision whether to grant an interim prohibitory injunction restraining the defendant from deleting or disposing of the Plaintiffs’ Data.  It also seems to me somewhat far‑fetched to suggest that the 1^st plaintiff should have drawn attention to potential obstacles under the privacy laws of multiple jurisdictions for the defendant to disclose the 1^st plaintiff’s former staff’s personal information back to the 1^st plaintiff.  There was therefore no material non‑disclosure in relation to this matter.

62.The final complaint of non‑disclosure relates to miscellaneous matters stated in Stephon Ye’s 2^nd affirmation.  I do not consider the reasons and circumstances concerning Liu’s resignation to be material to the ex parte application.  The thrust of the 1^st plaintiff’s evidence before the ex parte judge concerned the information gathered from Whistleblower 1 and Whistleblower 2, and the allegations about potential deletion or destruction of data.  It is true that it was stated in the ex parte skeleton argument at §2.6 that the allegations had “prompted an urgent internal investigation (which is ongoing) and recent resignations of the CEO of [the 1^st plaintiff] (ie Stefan Liu) and other senior management in [the 1^st plaintiff’s group]”.  Whether or not this is accurate does not seem to me to matter in the overall context, as Liu’s resignation did not go to the substance of the 1^st plaintiff’s application, but was merely part of the historical background.

63.As to information about KVB Prime, the objection as expressed in Ye’s 2^nd affirmation was that the 1^st plaintiff “did not seek to check or verify the matter before it made [the allegations] against [Liu]”, and that the 1^st plaintiff “should know that ‘KVB’ is a reputable name and it would not be surprising that some other people would be seeking to derive undue benefit by using the name of ‘KVB’ without authorization”.  It is unclear what information the defendant says the 1^st plaintiff should have supplied to the ex parte judge as regards KVB Prime.  On the face of it, the critical materials referred to in the 1^st affirmation of Liu (eg reports by the counsel of KVB Holdings about potential misuse of the KVB name and the advice that KVB Prime should not be pursued for intellectual property claims) do not bear any contemporaneous records, and their very existence is a dispute between the parties.  I am not satisfied that material non‑disclosure in this respect occurred. 

64.Lastly, it seems to me the fact that the operation of the Key Systems was not adversely affected by the defendant’s alleged wrongdoing is immaterial.  The basis of the 1^st plaintiff’s ex parte application is that the Plaintiffs’ Data was at risk of imminent deletion, not that the Key Systems would be compromised.  

Fortification

65.The basis on which the defendant seeks fortification for the 1^st plaintiff’s cross‑undertaking is two‑fold: (i) the defendant would be required to continue to incur expenses for compliance by way of maintenance and storage charges; and (ii) there is evidence showing the 1^st plaintiff’s business has been declining since the commencement of the present action.

66.The evidence is that, as at 30 June 2020, the 1^st plaintiff had net assets of approximately HK$365,121,000, with cash and bank balances of approximately HK$364,592,000.  The expenses the defendant relies upon are monthly storage charges of HK$1,700 each.  This is an insignificant amount to the 1^st plaintiff. I do not think there is any sound basis for belief that the 1^st plaintiff would be unable to make good its cross‑undertaking if called upon to do so.  I decline to require fortification.

Disposition

67.For the above reasons, I consider that the injunction sought should in principle be granted.  Given the defendant’s offer through its counsel for the Undertakings to continue instead in that event, I shall make no formal order for an injunction on the 1^st plaintiff’s summons, upon the defendant giving the Undertakings as renewed until the trial of the action.  The defendant’s summons is dismissed.  

68.In the absence of agreement, costs will be dealt with on the basis of written submissions, to be lodged by the plaintiffs within 21 days hereof and the defendant 7 days thereafter.

Mr Vincent Lung, instructed by Ince & Co, for the 1^st to 4^th Plaintiffs

Mr Rimsky Yuen SC and Mr Martin Ho, instructed by Chiu & Partners, for the Defendant