Press Releases

     Following is a question by Dr Hon Margaret Ng and a written reply by the Secretary for Constitutional and Mainland Affairs, Mr Stephen Lam, in the Legislative Council today (April 6):

Question:

     According to the Year Ender 2010 released earlier by the Office of the Privacy Commissioner for Personal Data ("PCPD"), 1 179 complaint cases related to suspected contravention of the Personal Data (Privacy) Ordinance (Cap. 486) ("the Ordinance") were received by PCPD in 2010, but only 12 of these cases were referred to the Police for consideration of prosecution. Among the cases referred to the Police, prosecution was instituted for only one case so far (the offender was convicted by the court), prosecution would not be instituted for seven cases, and the remaining four are still being followed up. There have been comments that the aforesaid rather low prosecution and conviction figures may give an impression to the public that "the law is laid aside and unused". In this connection, will the Government inform this Council:

(a) whether it knows why PCPD did not make any referral to the Police for a great majority of these complaint cases, and why prosecution has not been instituted by the Police in a majority of the cases referred to them; and

(b) whether the authorities will refine the prosecution policy relating to the Ordinance with a view to enhancing enforcement against contravention of the Ordinance; if they will, of the details?

Reply:

President,

     My reply to the two parts of the question is as follows:

(a) The Office of the Privacy Commissioner for Personal Data (PCPD) completed 1 076 complaint cases in 2010. Amongst these, 928 cases involved allegations on contravention of data protection principles (DPPs), which did not constitute any criminal offence. One of them involved contravention of an enforcement notice and was referred to the Police for further investigation. The remaining 148 cases involved alleged offences under the Personal Data (Privacy) Ordinance (the Ordinance) (Cap. 486). Of these 148 cases, after considering the information collected, the Privacy Commissioner for Personal Data (Privacy Commissioner) referred 11 of them to the Police for further investigation. Details of the remaining 137 cases are as follow:

* Three cases in which the parties complained against took remedial action by signing an undertaking;

* One case in which no contravention of the requirements under the Ordinance was found after investigation;

* Nine cases were outside the purview of the Ordinance;

* 61 cases were found to have no prima facie evidence;

* Four cases were withdrawn by the complainants during enquiries;

* Five cases were found to be unsubstantiated after enquiries with the parties being complained against;

* 51 cases in which the complainants had not responded to enquiries from the PCPD; and

* Three cases were resolved through mediation.

     Of the 12 cases referred by the Privacy Commissioner to the Police for further investigation, one was withdrawn by the complainant and three cases are still under investigation. For the eight remaining cases, two cases resulted in conviction. The other six cases were not prosecuted by the Department of Justice (DoJ) because of insufficient evidence after considering factors such as the actual circumstances of the relevant acts and the evidence collected.

(b) The Statement of Prosecution Policy and Practice is applicable to the prosecutions instituted under the Ordinance. The reasonable prospect of conviction will be taken into account by the DoJ when considering prosecution. If there is a reasonable prospect of conviction, further assessment will be made on whether prosecution is in the public interest. The existing prosecution policy is based on sound legal principles to ensure that criminal justice can be administered to all in a fair and just manner.

     Instituting prosecution is one of the aspects of law enforcement. According to the Ordinance, the Privacy Commissioner may also handle the complaints received through other enforcement actions (for example issuing warning letters or enforcement notices to the parties complained against). As such, the effectiveness of the enforcement of the Ordinance cannot be simply measured by referring to the number of prosecution cases.

Ends/Wednesday, April 6, 2011