The Commissioner of Police v. The Privacy Commissioner for Personal Data
Read the full judgment text of CACV 229/2011 on BabelCite. This Court of Appeal judgment was delivered on 13 June 2012.
1. This is the hearing of a case stated by the Administrative Appeals Board (“the Board”) on 21 October 2011 pursuant to section 24(1) of the Administrative Appeals Board Ordinance. Under this provision, the Board may, before an appeal is determined, refer any question of law arising in the appeal to the Court of Appeal for determination by way of case stated.
Cited by 1 case · Cites 1 case
|
CACV 229/2011 IN THE HIGH COURT OF THE HONG KONG SPECIAL ADMINISTRATIVE REGION COURT OF APPEAL CIVIL APPEAL NO 229 OF 2011 ____________
____________
________________________________ REASONS FOR JUDGMENT ________________________________ Hon Kwan JA: 1.This is the hearing of a case stated by the Administrative Appeals Board (“the Board”) on 21 October 2011 pursuant to section 24(1) of the Administrative Appeals Board Ordinance. Under this provision, the Board may, before an appeal is determined, refer any question of law arising in the appeal to the Court of Appeal for determination by way of case stated. 2.The question of law referred to this court for determination is as follows:
Background facts 3.The relevant background facts for present purpose, taken from the case stated, may be briefly stated as follows. 4.On 6 October 2007, the complainant made two data access requests (“DARs”) to the Hong Kong Police Force under s 18(1) of the Personal Data (Privacy) Ordinance (“the Ordinance”) on his own behalf and on behalf of his son for “police data regarding offences or convictions” for the period from 2004 to 2007. The DARs were made in a form specified by the Police under the Ordinance. At the request of the Police to clarify the kind of police report he was requesting, the complainant replied on 8 October stating that he wished the Police to “confirm in writing” they “do not hold any records of criminal offences or convictions for [the complainant and his family] (period 2004 – 2007 inclusive)”, and if the Police should hold any such records, they were requested to supply the date and nature of the offence. 5.The Police responded to the complainant on 9 October 2007 advising that they provided two kinds of services, namely:
6.The complainant was not applying for a CNCC. On 9 October 2007, the complainant replied to the Police saying that he regarded the Police as denying his requests. The Police did not hold any conviction data in respect of the complainant or his son and took the position that section 18 of the Ordinance only required them to “inform” the complainant they did not hold the data requested and they would do so verbally in accordance with their established procedure. They invited the complainant and his family to come to the Police office to have CCD Access and be verbally informed of the result. 7.The complainant disagreed with the position taken by the Police and made a complaint to the Privacy Commissioner for Personal Data (“Privacy Commissioner”) on 15 November 2007. 8.On 31 December 2007, the Privacy Commissioner notified the complainant that he had decided not to carry out or continue an investigation into the complaint, as he was of the view that section 18 did not require the Police to inform the complainant in writing whether they held the data requested and a verbal reply would be sufficient. The complainant had declined to attend the Police office so that he could be verbally informed. The Privacy Commissioner found there was no contravention of s 18(1)(a) and s 19 of the Ordinance. 9.The complainant appealed to the Board against the decision of the Privacy Commissioner. This is Administrative Appeal No 1 of 2008 (“the 1st Appeal”). The 1st Appeal 10.The Board handed down its decision on 10 December 2008 and allowed the appeal. They did not agree with the Privacy Commissioner’s interpretation of s 18(1)(a), for the reasons which appeared in paras 16 to 18 of the decision:
11.The Board remitted the case to the Privacy Commissioner to continue his investigation. 12.On 15 April 2010, the Privacy Commissioner issued a Result of Investigation of the complaint and made, inter alia, the finding that the Police’s failure to provide a written reply to the complainant’s DARs contravened s 19(1) of the Ordinance. The Privacy Commissioner issued an enforcement notice the same day, requiring the Police to inform the complainant in writing that they do not hold the data requested under the DARs, within 21 days after service of the enforcement notice. 13.On 28 April 2010, the Commissioner of Police lodged an appeal against the Privacy Commissioner’s decision. This is Administrative Appeal No 10 of 2010 (“the 2nd Appeal”) and was heard by a differently constituted Board. The 2nd Appeal 14.The Board handed down its decision on 5 May 2011. The core issue was whether the Police, in order to comply with the complainant’s DARs under s 18(1)(a), must give a written reply where the Police do not hold any relevant criminal conviction data. The Board considered whether it is legally permissible for the Police to give a verbal reply that they do not hold any relevant personal data is a question of law the answer to which would depend on the true construction of s 19(1). Although the Privacy Commissioner originally shared the view of the Police regarding the proper construction of s 19(1), the Privacy Commissioner considered himself bound by the decision of the Board in the 1st Appeal. Counsel for the Privacy Commissioner submitted it would cause a chaotic situation if the Board in the 2nd Appeal were to come to a different conclusion from the Board in the 1st Appeal. In view of this, and as the question raised is of great general importance, the Board decided to refer the question of law for determination by the Court of Appeal by way of case stated. The statutory provisions 15.We are concerned with ss 18 and 19 of the Ordinance. I set out the relevant parts in full:
The approach to statutory interpretation 16.The established principles are conveniently set out in HKSAR v Cheung Kwun Yin (2009) 12 HKCFAR 568 at paras 12 to 14. In summary, the court adopts a purposive interpretation. The statutory language is construed having regard to its context and purpose, and words are given their natural and ordinary meaning unless the context or purpose points to a different meaning. Context and purpose are considered when interpreting the words used, not only when an ambiguity may be thought to arise. 17.The context of a statutory provision should be taken in its widest sense and certainly includes the other provisions of the statute and the existing state of the law. The purpose of a statutory provision may be evident from the provision itself. The purpose may also be ascertained from a report where the legislation implements the recommendations of the report, the explanatory memorandum to the bill, a statement in the Legislative Council by the responsible Government official in relation to the bill. 18.Our attention was also drawn to the general interpretative principle that the court presumes, unless the contrary intention appears, that the legislator intended to conform to legal policy, which is based on public policy (Bennion on Statutory Interpretation, 5th ed, page 769). Relevant aspects of legal policy for present purpose would include the basic principles that law should serve the public interest (Bennion, pages 779 and 786) and that it should be certain and predictable (Bennion, page 799 and the principle against doubtful penalisation, namely that a person should not be penalised except under clear law (Bennion, pages 784 and 825 to 831). Construing the statutory provisions 19.Miss Ismail, who appeared for the Commissioner of Police, in a well reasoned submission, took us through the construction exercise with regard to the natural and ordinary meaning of ss 18 and 19, the context of these provisions, and the purpose and public policy of these provisions. I shall follow the same scheme in her submission. The natural and ordinary meaning 20.Miss Ismail submitted where compliance with a data access request under s 18(1)(a) is required by s 19(1), the request would be complied with by the data user once the requestor is “informed”. Neither s 18(1)(a) nor s 19(1) makes provision for the manner of compliance with a data access request beyond what is stated in s 18(1)(a), namely, that the requestor is “to be informed”. The natural and ordinary meaning of “to be informed” is to be told or given information, whether in writing or verbally or otherwise (The Oxford English Dictionary, 2nd ed, Vol VII, definitions of “inform” at pages 942 to 943 and “informed” at page 947). 21.I do not understand Mr Kwok Sui Hay, who appeared for the Privacy Commissioner, to have contended otherwise. The context 22.S 19(1) requires a data user to comply with a data access request within 40 days unless: (a) the data user is unable to comply with this temporarily (as addressed in s 19(2)); or (b) where s 20 applies, namely, if one or more of the circumstances exist in which a data user shall or may refuse to comply with a data access request; or (c) where s 28(5) applies, in which a data user may refuse to comply with a data access request unless and until any fee imposed by the data user for complying with the request has been paid. 23.Miss Ismail submitted it is clear that none of the above exceptions apply in the present case. There is no controversy about the situations in (b) and (c). But Mr Kwok argued that the present case does fall within (a). I will come back to his argument. 24.Miss Ismail went on to submit that whilst various provisions in s 19 contain express requirements for certain matters to be notified in writing to the requestor in particular instances, no such requirement is expressed in respect of providing information as to a lack of personal data pursuant to a data access request under s 18(1)(a). We were taken through the relevant provisions in s 19(2) to (4). 25.S 19(2)(a)(i) provides for the situation where the data user is temporarily unable to comply with the data access request within 40 days after receiving the request. In that case, the data user shall before the expiration of the 40-day period, by notice in writing inform the requestor he is so unable and the reasons why he is so unable. S 19(3)(b) covers the situation in which personal data are to be supplied and where correction has been made to the data. In that case, the data supplied to the requestor are to be accompanied by a notice stating that the data have been corrected. S 19(4)(b) governs the situation where the data access request specifies the form or forms in which a copy of the personal data to be supplied is sought and the data user is unable to supply the copy in that form or any of those forms. Where there is only one form in which it is practicable for the data user to supply the copy, the data user shall supply the copy in that form accompanied by a notice in writing informing the requestor of this. In any other case, the data user shall by notice in writing inform the requestor it is not practicable to supply the copy of the personal data in the form or any of the forms specified in the request, and of the forms in which it is practicable to supply the copy. 26.Hence, none of the above situations in which notice in writing is required would appear to apply to the present case, where the Police do not hold the relevant personal data requested under s 18(1)(a). In paras 17 and 18 of the decision in the 1st Appeal, the Board reasoned that as notice to the requestor is required to be given in writing in various situations in s 19(2), (3) and (4), and as the data access request is required to be in writing, it would be unreasonable if not absurd to suggest that the requestor would only need to be verbally informed in the present case where no relevant personal date are held without being inconsistent with the requirements of section 19. I do not agree with this reasoning. There is no unreasonableness, absurdity or inconsistency involved. The situations in which written notice is required do not apply to the present case. I should add that the Board in the 1st Appeal did not have the benefit of full legal submissions as the Police were not legally represented. 27.Next, Miss Ismail pointed out that in the Ordinance, the draftsman has adopted at least four different formulae: (a) “be informed”, “to inform” (as in ss 18(1)(a), 34(1)(i), Schedule 1 paras 1(3), 2(1)(c), 5(b) and (c), Schedule 5 para 6); (b) “informed in writing” (as in ss 56(i) and (ii)); (c) “by notice in writing inform” (as in ss 19(2)(a)(i), 19(4)(i) and (ii), 21(1), 23(2)(a), 25(1), 39(3), 41(1), 42(3), 46(5) – which formula is the subject of further provisions at ss 29 and 68 in respect of the language and manner of service of such notices; and (d) “in such manner and at such time as he thinks fit, inform” (as in ss 47(1), (2) and (3), 49(ii)(A)). She submitted that if written notification had been required for compliance with a s 18(1)(a) request, this could easily have been expressly stated, but it was not. Hence, the context of s 18(1)(a) and 19 is that if written notification is required by the Ordinance, that is expressly stated. Accordingly, the context supports the natural and ordinary meaning of “informed” being attributed to that word in s 18(1)(a). In further support of this, she referred us to Hong Kong Data Privacy Law by Berthold and Wacks, 2nd ed, para 8.48; Data Protection Principles in the Personal Data (Privacy) Ordinance – from the Privacy Commissioner’s Perspective, 2006 and 2010 ed, para 10.23; PCPD’s Information Paper on Review of the Personal Data (Privacy) Ordinance, 2009, Proposal No 55. 28.I agree with all her submissions above. 29.I turn to Mr Kwok’s submission that as a data access request under s 18(1) is treated as a single request by virtue of s 18(2) and (3), the only permissible way to comply with a s 18(1)(a) data access request must be in writing, “given that s 19 stipulates that a data request must be complied with in writing”. 30.Mr Kwok referred us to s 18(2) which provides that a data access request under both s 18(1)(a) and (b) shall be treated as a single request, and s 18(3) which provides that a data request under s 18(1)(a) may, in the absence of evidence to the contrary, be treated as a request under both s 18(1)(a) and (b). He submitted that as the DARs in the present case sought “police data regarding offences or convictions” and the Police were requested to supply the date and nature of the offence if they hold any criminal records for the complainant and his family, the DARs were requests made under both s 18(1)(a) and (b) and should be treated as a single request by virtue of s 18(2), and possibly s 18(3). I have no problem with that. 31.Next, Mr Kwok submitted that as both s 18(2) and (3) stipulate “the provisions of this Ordinance shall be construed accordingly”, that would include the provisions in s 19. He relied on s 19(2) and argued that the present case would fall within that provision as the data user “is unable to comply” with the single request in that the Police do not hold any relevant criminal record. But that is to misread s 19(2). It is clear from the wording of s 19(2)(b) that this provision covers the situation where the data user is unable to comply with the data access request within the specified period of 40 days in s 19(1), namely, temporarily, as s 19(2)(b) stipulates that “as soon as practicable after the expiration of that period”, the data user shall comply or fully comply with the request. Besides, the Police were not unable to comply with the single request. They would have complied with it by informing the complainant that they do not hold any relevant criminal record. 32.I fail to see the basis on which Mr Kwok derived the premise that s 19 stipulates that a data request must be complied with in writing. I do not agree with his contention. As has been analysed earlier, s 19(2), (3) and (4) contain provisions laying down the requirement of written notification in specific situations. These provisions do not stipulate that a data access request must be complied with in writing, nor do they apply to the situation where the data user does not hold the personal data being the subject of the request. The purpose and public policy 33.Miss Ismail took us first to the Ordinance. S 4 provides that a data user shall not do an act that contravenes a data protection principle unless required or permitted by the Ordinance. Data Protection Principle 6, which is concerned with access to personal data, provides that a data subject shall be entitled to ascertain whether a data user holds personal data of which he is the data subject. Miss Ismail made the valid point that nothing in Principle 6 indicates that such information should be provided in writing, as opposed to simply being provided. 34.As stated in the explanatory memorandum to the Personal Data (Privacy) Bill 1995, the bill gives effect to the majority of the recommendations contained in the report of the Law Reform Commission on Reform of the Law Relating to the Protection of Personal Data published in 1994. Chapter 14 of the report deals with data subjects’ rights of access and correction. As pointed out by Miss Ismail, no recommendation was made as to the form of the information as to whether the data user held relevant data. The Commission had regard to the Rehabilitation of Offenders Ordinance, Cap 297 in para 3.15 of the report, and the “forced access” issue, in the context of whether it should be a criminal offence to require a data subject to exercise his data access rights to reveal his criminal record (paras 14.40 to 14.42). 35.Miss Ismail submitted there is public policy interest involved in maintaining the natural and ordinary meaning of the statutory provisions. The Police have provided details of their concerns relating to the provision of written confirmation of no criminal records in their submission to the Board in the 2nd Appeal, which are similar to the concerns noted in paras 14.41 and 14.42 of the Law Reform Commission Report. In summary, criminal conviction records are regarded as sensitive personal data to be released in very restrictive circumstances. A written confirmation requirement might lead to an abuse of the data access request system by enabling employers to force prospective employees to prove they have no convictions. Possible “forced data access” by employees would go against the spirit of the Rehabilitation of Offenders Ordinance, as well as the Ordinance, which is intended to protect rather than discriminate against persons with criminal convictions. The consequence of “forced data access” would be to create an unemployable “underclass” unable to provide records of no convictions, with potential impact on social stability. See also Hong Kong Data Privacy Law by Berthold and Wacks, paras12.47 to 12.51. 36.I agree these public interest concerns are powerful considerations. 37.There is also the principle against doubtful penalisation. A contravention of s 19(1) without reasonable excuse is an offence under s 64(10). This is another reason why ss 18(1)(a) and 19(1) should not be construed so as to penalise a person for giving information orally, where it is not clearly stated by the legislature that the information must be in writing. See PCPD’s Information Paper on Review of the Personal Data (Privacy) Ordinance, 2009, Proposal No 55 para 6. 38.I note that there is legislative amendment in the pipeline regarding s 19(1) in the Personal Data (Privacy) (Amendment) Bill 2011, the effect of which is to provide expressly for the manner of compliance with a data access request in writing and to permit the Police to inform the requestor orally they do not hold any record of criminal conviction of an individual. I have not relied on this in the construction of the existing statutory regime. However, whilst the post-enactment development of the proposed amendment to s 19 of the Ordinance by clause 12 of that Bill is, of course, not relevant to the construction of s 19 of the Ordinance as it stands at present, the proposed amendment does clearly support the public policy concerns of the Police as reflected in paras 14.41 and 14.42 of the Law Reform Commission Report. Conclusion and orders 39.For the above reasons, I have answered the question of law referred by the Board in the affirmative, that on the true construction of s 19(1) of the Ordinance, it is legally permissible for a data user, in compliance with s 18(1)(a), to inform the requestor verbally that the data user does not hold personal data of which the requestor is the subject. 40.There is no reason to depart from the usual rule that costs should follow the event and we have so ordered at the conclusion of the hearing. Hon Fok JA: 41.I fully agree with the reasons for judgment of Kwan JA and there is nothing further I wish to add. Hon Bharwaney J: 42.I agree with the judgment of Kwan JA.
Miss Roxanne Ismail, instructed by the Department of Justice, for the appellant (appellant) Mr Kwok Sui Hay, instructed by Oldham, Li & Nie, for the respondent (respondent) |
Cases cited in this judgment
Other judgments that cite this case