Hong Kong Data Privacy 2015: Cautious Enforcement, Strong Principles

Abstract

For seventeen years, Hong Kong’s 1995 Personal Data (Privacy) Ordinance, the first comprehensive data privacy law in Asia, remained without substantial amendments. The Amendment Bill of 2012, in force since April 2013, involved fewer changes than were recommended by Hong Kong’s Privacy Commissioner, but were nevertheless a significant strengthening of the Ordinance.

Two and half years later, the stronger enforcement regime is still only being applied cautiously. However, the Commissioner and the tribunal administering the Ordinance have both given its substantive principles increasingly strong interpretations.

This article reviews these developments. Aspects covered include the first direct marketing fines, the first jail sentence, the appeal decision upholding coverage of publicly available information, decisions concerning collection by unfair means and limits on excessive collection, and legislation on third party rights under contracts.

Keywords: Hong Kong, China, privacy, data protection, enforcement, direct marketing