A v. Administrative Appeals Board

HCAL 221/2017

[2018] HKCFI 2029

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CONSTITUTIONAL AND ADMINISTRATIVE LAW LIST

NO 221 OF 2017

___________________

___________________

___________________

D E C I S I O N

___________________

Introduction

1.  This is the second time that the applicant has brought judicial review proceedings in respect of the disclosure of personal data that she had provided to a women’s support group which was the subject matter of two separate complaints by her to the Privacy Commissioner for Personal Data (“the PCPD”), which were successively rejected and then successively dismissed on appeal to the Administrative Appeals Board (“the AAB”). 

2.  This application for leave to apply for judicial review is in relation to the decision of the AAB in Administrative Appeal No. 18/2016, dismissing the applicant’s appeal against the decision of the PCPD, pursuant to section 39(2)(d) of the Personal Data (Privacy) Ordinance, Cap 486, (the Ordinance), not to pursue the applicant’s complaint. 

3.  I have come to the view that the application is not reasonably arguable and is therefore refused.  These are my reasons.  Other than in relation to the applicant, I will adopt the designations of the participants in this case as stated in the decision of the AAB.

The background facts

4.  The applicant is a British national who resides in Hong Kong.  She is a single mother with a young son.  In November 2010, the applicant was arrested for alleged credit card fraud and placed on police bail. 

5.  In March 2011, the applicant’s son, who was then aged two, was placed in institutional care pursuant to a care and protection order on suspicion of the applicant committing the offence of child abuse or neglect. 

6.  The applicant sought assistance from PathFinders Limited (PathFinders), an approved charitable institution, whose principal role is to provide assistance and support to distressed migrant mothers and their children born in Hong Kong.  PathFinders assigned a case officer to the applicant to give her assistance and support as required. 

7.  In June 2011, PathFinders ceased providing assistance to the applicant after the police lifted the imposition of bail in relation to the alleged credit card fraud, and following a court order that the applicant’s son be returned to her care.

8.  In February 2013, the applicant was rearrested for the alleged credit card fraud.  Some time at the end of March 2013, the applicant again sought the assistance of PathFinders. She was brought into contact through a mutual acquaintance with a director of PathFinders who was designated her principal case officer (in the AAB decision she was referred to as the Person Bound).  The previous case officer was designated her secondary case officer.  Other case officers were also involved in assisting the applicant with her case. 

9.  The Person Bound immediately arranged legal representation for the applicant.  At about this time in early April 2013, the applicant was evicted from her rented premises.  The applicant together with her son stayed intermittently at the Person Bound’s home.  There were also occasions when the applicant was hospitalised that the Person Bound looked after her son.

10.  On 9 April 2013, another person was assigned by PathFinders as the case manager of the applicant’s case. 

11.  Pathfinders has a published privacy policy and on 15 April 2013, the applicant signed a “Consent to Release or Obtain Personal Data”, authorising representatives of PathFinders to obtain or release her personal data as required in the provision of services to her and her child.

12.  Throughout this period the case officers, particularly the Person Bound, of PathFinders assisted the applicant to find new premises and help her with her legal case, as well as assisting her with her mental health problems that she appeared to be suffering at the time. 

13.  According to PathFinders, the client relationship with the applicant came to an end in July 2013 and her case was formally closed on 7 October 2013.  However, the Person Bound continued supporting and assisting the applicant in her personal capacity, helping her with her personal matters, to the extent of allowing the applicant and her son to reside in her home and caring for her son when she was admitted to hospital. 

14.  Soon after in March 2014, the applicant received a Prosecution Bundle in relation to her trial in the District Court.  It appears that at the second AAB hearing, it was acknowledged that the Person Bound was supplied with the prosecution bundle which at the time became the subject of discussion between the various parties assisting the applicant in defending her case.  This all took place with the applicant’s acquiescence, as those helping her, particularly the Person Bound, believed she was innocent of the crime alleged against her.

15.  In a series of emails, from 12 to 14 April 2014, between the applicant and the Person Bound, the Person Bound mentioned twice that she had spoken to the applicant’s parents to help them understand the situation concerning her case.  The applicant in reply did not object on either occasion to the Person Bound having spoken to her parents. It appears that the Person Bound had also expressed her concern about the applicant being less than frank with them concerning her case which she eventually acknowledged she had committed.  It was about this time that the relationship between the applicant and the Person Bound deteriorated, and sometime later they stopped communicating with each other.

16.  Notwithstanding the downturn in the relationship between the applicant and the Person Bound, the Person Bound continued to assist the applicant for the sake of her son’s welfare and best interests. 

17.  In an email dated 14 April 2014 from the Person Bound to the applicant, she said: “… I will only act for [your son] so he can get to a safe, stable home ASAP and live a life cleared of your deceits…”.  On this basis, the Person Bound agreed to help the applicant but only on a number of conditions which in brief required the applicant to plead guilty to the fraud charge; to tell the applicant’s friends, family and supporters the truth in respect of the fraud charge and to apologise to them; to ask for forgiveness from and agreed to repay those persons whom the applicant had defrauded over the years; and to agree to the transfer of guardianship of the applicant’s son to the applicant’s parents (in the AAB decision they were referred to as Mr and Mrs D).  The applicant agreed to these terms of assistance as evidenced in an email dated 2 May 2014 from her to the Person Bound.

18.  On 17 April 2014, the applicant signed a Deed of Appointment of Guardians, appointing her parents as guardians of her son.  It was stated in the Deed that the applicant was desirous of her son being placed in the care of her parents and taken to their home in the United Kingdom where he should live and attend school, until such time as the applicant was in a position to provide a secure and stable home and take care of her son herself.  The Deed was executed by the applicant and her parents at the offices of the solicitors who had prepared the Deed.  The Person Bound was also present when this was done.

19.  On 12 June 2014, the applicant pleaded guilty to the criminal charges that had been brought against her in the District Court and she was sentenced to a term of imprisonment of 12 months suspended for a period of 24 months.

20.  In July 2014, the applicant took out an action against her parents in the High Court (Family Division) in London for custody of her son. 

21.  In a series of emails on 1 August 2014, the father of the applicant told the principal case officer that he and his wife had been accused by the applicant of abduction of her son.  The father sought information and evidence from the Person Bound that could be used to rebut such allegation and to contest the proceedings brought against them by the applicant.

22.  It was during these proceedings that the applicant became aware of an email dated 2 August 2014 from the Person Bound to the applicant’s parents where she disclosed to them the Prosecution Bundle, and a chronology of events compiled by the Person Bound, entitled Timeline of Events, in order to assist the applicant’s parents defend the action. 

23.  It appears that the Person Bound supplied this information to the applicant’s parents on the basis of permission previously given to her in her personal capacity by the applicant to share police evidence and anything else with the applicant’s parents in order for them to have the full story.  This was set out in the Person Bound’s email of 2 August 2014 to the applicant’s parents.  She said, amongst other things, in her email that the applicant: “… gave me permission in my personal capacity to share the police evidence and anything else with you, to give you the full story.  She has not since rescinded that permission.  She has not asked you to keep this information confidential … I urge you to review the previous emails I have sent you outlining why [the applicant] is incapable of caring for [her son] from a purely financial perspective …”. 

24.  In the email, the Person Bound attached the Timeline of Events, but the Prosecution Bundle was not attached to this or any of the other emails. 

The first complaint

25.  On 9 February 2015, the applicant lodged her first complaint with the office of the PCPD against PathFinders.  In that complaint, the applicant alleged that in August 2014, Pathfinders, acting through the Person Bound, disclosed her personal data to her parents in defending the action that she brought against them. 

26.  The PCPD in a written decision dated 30 April 2015 decided not to pursue the complaint (“the first PCPD Decision”).[1]  The PCPD was of the view that the Person Bound was acting in her personal capacity in her dealings with the applicant after PathFinders had ceased providing any assistance or service to her and were therefore not responsible for disclosing any other personal data to her parents. 

27.  On 27 May 2015, the applicant appealed the first PCPD Decision to the AAB which was heard on 23 February and 5 May 2016.  The AAB dismissed the appeal in a written decision handed down on 17 October 2016 (“the first AAB Decision”).[2] On 30 December 2016, the applicant filed an application for leave to apply for judicial review of the first AAB Decision.  The leave application was heard on 5 April 2017 and refused by this Court in a written decision dated 7 April 2017 (“the first Judicial Review Decision”).[3]  The applicant applied for extension of time to appeal the first Judicial Review Decision on 27 April 2017 which was dismissed by the Court of Appeal in a written judgment dated 21 July 2017.[4]  The Court held that the decision of the AAB was lawfully reached in accordance with proper procedures and was clearly not unreasonable in all the circumstances of the case.  The Court went on to observe the fact that the applicant’s evidence and submissions to the AAB were to the contrary was quite simply insufficient to render the findings of the AAB irrational or unreasonable, and that her submissions on appeal were just a re-run of the arguments that had been rejected by the AAB.  The Court concluded that the applicant’s intended appeal was quite hopeless and would have no reasonable prospect of success.

The second complaint

28.  On 17 April 2015, the applicant lodged her second complaint with the office of the PCPD against the Person Bound.  The Deputy PCPD in a written decision dated 11 March 2016 decided not to pursue the complaint (“the second PCPD Decision”).[5] The Deputy PCPD was of the view that even if the Person Bound had passed on the Prosecution Bundle to the applicant’s parents, it was consistent with the purpose for which it was disclosed protecting the welfare and interests of the applicant’s son, and therefore there was no contravention of Data Protection Principle 3 (DPP 3).  This principle provides that personal data should not be used (including disclosure) for a new purpose without the prescribed consent of the data subject.  A “new purpose” refers to any purpose other than that prescribed at the time of collection of the personal data or a purpose directly related to it. 

29.  The Deputy PCPD concluded that on the disclosure of the Timeline of the Events and the Prosecution Bundle that the Person Bound disclosed the material to her parents for the purpose of safeguarding the interests of her son which was one of the purposes for her collecting the applicant’s personal data and therefore did not give rise to a contravention of DPP 3.  She also went on to discuss whether the exemption to DPP 3 of remedying “seriously improper conduct” would apply.

“25. The legal proceedings instituted by you in London was made under the Hague Convention on the Civil Aspects of International Child Abduction, which aims to remedy child abduction across the borders by returning the child concerned to his habitual place of residence. On 1 August 2014, your father wrote to [the Person Bound] seeking information to defend the proceedings on the belief that you accused your parents of abducting your son. It was against such factual background that [the Person Bound] compiled the Timeline of Events and sent to your father by email the next day.

26. Section 58(1)(d) and (2) of the Ordinance exempts personal data from DPP 3 where the data is used for the purpose of ‘prevention, preclusion or remedying (including punishment) of unlawful or seriously improper conduct, or dishonesty or malpractice, by persons’, and the application of DPP 3 in relation to such use would be likely to prejudice any of the said matters.  I consider child abduction is a seriously improper conduct which [the Person Bound] may exercise the exemption to disclose your personal data to your parents under the circumstances for admission as evidence in the London proceedings.  I am of the view that the above exemption applies to your case in any event.”

30.  On 6 April 2016, the applicant appealed the second PCPD Decision to the AAB which was heard on 13 October 2016 by a differently constituted AAB from that that heard the first AAB Decision.  The AAB dismissed the appeal in a written decision handed down on 21 February 2017 (“the second AAB Decision”).[6] On 22 May 2017, the applicant filed an application for leave to apply for judicial review of the second AAB Decision.

The present leave application

31.  Immediately after taking out a summons for extension of time to appeal the first Judicial Review Decision, the applicant filed, on 22 May 2017, a notice of application for leave to apply for judicial review in relation to the second AAB Decision.  By direction from this Court dated 30 August 2017, the applicant was requested to indicate whether she would be proceeding with the application in light of the Court of Appeal’s decision of 21 July 2017, dismissing her application which concerned the same subject matter.  It was also noted that the applicant had requested an oral hearing and if the application proceeded further directions may need to be given.[7]

32.  In an undated letter received by this Court on 25 September 2017, the applicant submitted that the current judicial review proceedings were concerned with a different decision of the AAB and notwithstanding the Court of Appeal decision.  It is clear that all the proceedings are concerned with the same subject matter and allegations, involving the same parties.

33.  The applicant failed to mention to this Court and to the Court of Appeal in relation to the first judicial review that she had made another complaint arising from the same set of facts and involving the same parties. 

District Court proceedings

34.  After the hearing of the second judicial review, a decision was handed down in the District Court in relation to a civil action instituted by the applicant for loss and damage for breaches of data protection under the Personal Data (Privacy) Ordinance, Cap. 486, against the Person Bound and PathFinders.[8] At no time had the applicant mentioned to this Court either in the previous or present judicial review that she had initiated a civil action against the subjects of her complaints.  The writ and statement of claim in that action was filed by the applicant on 1 August 2016.  The result of those proceedings was that the applicant’s claim was struck out on the basis of res judicata with costs awarded against the applicant on an indemnity basis. 

35.  The nature of the pleadings and the evidence in support of the action, as well as whether the civil action may have constituted a means of alternative remedy, were matters of relevance to the judicial review proceedings.

36.  When the applicant was requested for an explanation as to why the private action was not disclosed to the Court, she claimed that she did not know that she had to inform the Court of the civil action that was in relation to different parties to the judicial review proceedings.  I have my doubts about the applicant’s explanation, given her familiarity with the legal processes and access to legal assistance.

Undue delay

37.  It is a fundamental requirement that an applicant for leave to apply for judicial review acts promptly and without undue delay.  A time period of three months has been stipulated within which to make an application for leave to apply for judicial review.  See section 21K (6) of the High Court Ordinance, Cap 4, and Order 53, rule 4 (1) of the Rules of the High Court.  See also Re Thomas Lai, Application for Leave to Apply for Judicial Review [2014] 6 HKC 1, paragraphs 36 to 45.

38.  In the present case, the applicant filed the second judicial review on 22 May 2017.  This was a day and three months after the decision under review was handed down on 21 February 2017.  What is of significance, is that the applicant had already initiated the first judicial review on 30 December 2016 which was heard on 5 April 2017 and refused on 7 April 2017.  The applicant filed an appeal against the refusal decision out of time on 27 April 2017 which was later dismissed by the Court of Appeal on 21 July 2017.  The civil action in the District Court was instituted by the applicant on 1 August 2016 which was struck out on 28 February 2018 after a hearing on 2 and 3 January 2018.

39.  This Court was not informed by the applicant in the first judicial review of the other related decision of the AAB and the prospect of an application to judicially review that decision which dealt with the same subject matter, which must have been under contemplation during the currency of the first judicial review, unless it only came about when the first judicial review was refused.  It seems to me that the applicant held in reserve the second judicial review, as a second bite of the cherry, if the first judicial review failed.

40.  I am of the view that in all the circumstances there has been undue delay in instituting the present application for judicial review.  The applicant has not acted promptly.  She waited until the last minute of the three-month period before filing her application, and even then she was a day late.  See Law Chun Loy v Secretary for Justice [2006] HKCU 1795, HCAL 13/2005, 26 October 2006, per Hartmann J (as he then was).  On this basis alone, I would refuse the application.

The grounds for judicial review

41.  The applicant has in a most unsatisfactory manner filed her notice for leave to apply for judicial review of the second AAB Decision by dumping on this Court all the court papers of the proceedings below including correspondence.  Accompanying a little under 800 pages of documents, is a lengthy written submission of about 40 pages which is difficult to understand and identify the grounds for judicial review.  The applicant’s submissions are in essence a repeat of the case that she presented in support of her complaint both before the PCPD and the AAB.[9] 

42.  As best as I can ascertain, the applicant advances four grounds for review.  First, the AAB decision was unreasonable and the manner in which it was made was not rational. Secondly, the AAB decision contained numerous errors which showed significant failings in the decision making process and in consequential findings, as well as failing to take into account numerous relevant factors.  Thirdly, the AAB erred in deciding that the exemption under section 58(2) applied to her case.  Fourthly, the AAB was wrong in law when it found there was no evidence to make a determination in favour of the applicant. 

43.  The hearing of the leave application therefore became an appeal of the merits of the applicant’s case rather than a review of the decision making process.  This was something that was stressed with the applicant in her unsuccessful attempt to appeal the first Judicial Review Decision where Kwan JA quoted with approval my comments in Li Wai Hung Cesario v Administrative Appeals Board [2015] 5 HKLRD 575.  I will not repeat them, but suffice to say that a judicial review is not an appeal or a rehearing of the merits of the case, it is concerned with the quality of the decision making process, focusing on ensuring that the decision is lawfully reached with proper procedures and is not unreasonable in those circumstances.

44.  From my overall assessment of the applicant’s case in the present judicial review, it is not very different from the case that she mounted in the first judicial review.  Her complaint focuses on the AAB’s findings of fact, or more particularly the AAB’s failure to take into account (i) that the Person Bound did not seek her consent prior to disclosure; (ii) that the disclosure was prior to the proceedings in the United Kingdom; and (iii) that the disclosure was made to assist her parents in defending the proceedings that she brought against them in the United Kingdom.  She adds in the present judicial review that the exemption of “serious improper conduct” was not justified because the proceedings in the United Kingdom was not a child abduction case but rather a child custody dispute and when the Person Bound disclosed her personal data it was in relation to her criminal proceedings and not in relation to a child custody dispute.

45.  The issue before the AAB was whether DPP 3 had been contravened.  This principle stipulates that “personal data shall not, without the prescribed consent of the data subject, be used for a new purpose”.  The AAB noted the definitions of “personal data” and “prescribed consent” under the Ordinance.  It also noted the exemptions under section 58(2) of the Ordinance from the provisions of DPP 3 which included the purposes as listed under section 58(1).  One of the purposes listed, relevant to the present case, was “(d) the prevention, preclusion or remedying (including punishment) of unlawful or seriously improper conduct, or dishonesty or malpractice, by persons”.

46.  The central issue in both of the applicant’s complaints has been whether the Person Bound disclosed the applicant’s personal data, consisting of a Prosecution Bundle and/or a Timeline of Events, to her parents.  It was not in dispute that the Person Bound provided information about the applicant’s court case and a Timeline of Events to the applicant’s parents, although the Person Bound took issue that she had provided a copy of the Prosecution Bundle.  It would seem that at the relevant time because of the applicant’s mental health problems and likely criminal conviction for credit card fraud, to which she was intending to plead guilty, arrangements were made for the applicant’s son to be placed in the custody and care of her parents.  

47.  It would also appear that a number of people including the Person Bound had rallied in support of the applicant believing that she was innocent of the credit card fraud, but when it became known that she had committed the crime, the relationship between the applicant and the Person Bound greatly deteriorated.  This was explained in the AAB Decision as follows. 

“13. By 12 April 2014, if not earlier, however, things had turned sour between the Appellant and the Person Bound, with the Person Bound accusing the Appellant of having indeed committed the fraud in question. Evidence of this is provided in an email dated 12 April 2014 from the Person Bound to the Appellant.

14. In a series of emails between the two women between 12 and 14 April 2014, the Person Bound mentioned twice that she had spoken to the Appellant’s parents to help them understand the situation. In the Appellant’s reply emails, the Appellant did not object on either occasion to the Person Bound having spoken to her parents.

15. Despite the downturn in the relationship between the Appellant and the Person Bound, the Person Bound continued to assist the Appellant in so far as, and only so far as, ensuring the Appellant’s son’s welfare and best interests were catered for.  In an email dated 14 April 2014 from the Person Bound to the Appellant, the Person Bound said, “…I will only act for [your son] so he can get to a safe, stable home ASAP and live a life cleared of your deceits…”

16. However, the Person Bound agreed to do so only on a number of conditions, the gist of which required the Appellant to plead guilty to the Fraud Charge; to tell the Appellant’s friends, family and supporters the truth in respect of the Fraud Charge and to apologise to these individuals; to ask for forgiveness from and agree to repay those whom the Appellant had defrauded over the years; and to agree to the transfer of guardianship of the Appellant’s son to Mr. & Mrs. D. The Appellant agreed to these terms of assistance (the “Terms of Assistance”), as evidenced in an email dated 2 May 2014 from the Appellant to the Person Bound.

17. On 17 April 2014, the Appellant and Mr. & Mrs. D signed a Deed of Appointment of Guardians, appointing Mr. & Mrs. D as the guardians of the Appellant’s son until such time as the Appellant would be in a position to provide a secure and stable home to take care of her son herself.  According to the Appellant, this was done in anticipation of the Appellant being sentenced to an immediate custodial sentence upon conviction for the Fraud Charge.  Very soon thereafter, Mr. & Mrs. D, who reside in the United Kingdom, took the Appellant’s son to the United Kingdom.”

48.  On 12 June 2014, the applicant was eventually convicted in the District Court of fraud on her own plea and sentenced to a term of imprisonment for 12 months which was suspended for 24 months.  It was soon after this that the applicant instituted proceedings in the United Kingdom under The Hague Convention on the Civil Aspects of International Child Abduction (which applies domestically to the United Kingdom pursuant to the Child Abduction & Custody Act 1985) against her parents seeking the return of her son to her care in Hong Kong. 

49.  As explained by the AAB, there were a series of emails on 1 August 2014 between the applicant’s father and the Person Bound who stated that he and his wife had been accused by the applicant of abducting the applicant’s son, and he sought information and evidence from the Person Bound to rebut the allegation and to show that it would be unsafe for the child to be returned to the applicant in Hong Kong. 

50.  The AAB then addressed the alleged disclosure by setting out the relevant facts and events. 

“22. In an undated email, but appearing to be in response to the 1 August emails from Mr. D, the Person Bound suggested, inter alia, showing the “Prosecution Bundle for [the Appellant’s] Criminal Fraud Case” to Mr. D’s lawyer, further stating that “[the Appellant] permitted me to send it to you and you have no obligation to keep it confidential”.

23. In an email dated 2 August 2014 from the Person Bound to Mr. D, the Person Bound mentioned, inter alia, that she had sent the “full police evidence files” to Mr. D a long time ago, implicitly suggesting that they be used in the London Action.

24. In another email dated 2 August 2014 from the Person Bound to Mr. D, the Person Bound said, inter alia,

“[the Appellant] gave me permission in my personal capacity to share the police evidence and anything else with you, to give you the full story.  She has not since rescinded that permission.  She has not asked you to keep this information confidential …  I urge you to review the previous emails I have sent you outlining why [the Appellant] is incapable of caring for [her son] from a purely financial perspective …”

In that email, the Person Bound attached a timeline of key events relating to the Appellant (the “Timeline of Events”) that the Person Bound suggested using to contest the London Action.

25. The Prosecution Bundle was not attached to any of these emails.”

51.  The AAB noted that the Timeline of Events had been adduced by the applicant’s parents in the proceedings in the United Kingdom, but that was not the case with the Prosecution Bundle. 

52.  It was noted by the AAB that on 17 April 2015, the applicant had filed a complaint with the PCPD, alleging that the Person Bound disclosed the applicant’s personal data, as contained in the Prosecution Bundle and Timeline of Events, to the applicant’s parents and the applicant’s clients between June and September 2014 without the applicant’s consent.  However, in later correspondence, the applicant agreed there was insufficient information to pursue the complaint in relation to her clients. It was also noted that the applicant filed a separate complaint in February 2015 against PathFinders on the same grounds, alleging that PathFinders was vicariously liable for the Person Bound’s actions.  The PCPD closed its investigation into that complaint on 30 April 2015 after finding that the Person Bound had been acting in her personal capacity in relation to the applicant. 

53.  On the issue of disclosure, the AAB made the following findings:

“102. Disclosure of the Timeline of Events by the Person Bound to Mr. & Mrs. D is undisputed. It is also undisputed that the Timeline of Events constituted personal data for the purposes of the PDPO.

103. As for whether the Prosecution Bundle had been disclosed to the Appellant’s parents, the Person Bound’s wording in the three emails sent by her in August 2014 to Mr. D is clear. The Person Bound said she had previously sent the police files to Mr. D and that the Appellant permitted her to send them to him.

104. The question is how is the conflicting evidence to be dealt with, as this was, according to Ms. Chan in her oral submissions, one of the reasons the Respondent found that there had been no disclosure of the Prosecution Bundle. The conflicting evidence is and was the Person Bound’s denials of such disclosure during the course of the Respondent’s investigation; the 3 June 2015 email from Mr. D confirming that he never received any police records relating to the Appellant from the Person Bound; and the series of emails on 12 August 2015 in which Mr. D’s final answer as to whether the Prosecution Bundle had been sent to him was “Sorry, I do not remember”.

105. This “conflicting” evidence all came into existence after the Appellant filed the Complaint and indeed in response to the Complaint. They are to a large extent self-serving in nature and must therefore, in our judgment, be taken with a pinch of salt.

106. The Person Bound’s three emails in August 2014, on the other hand, came into existence at a time contemporaneous with the period when the Prosecution Bundle was alleged to have been unlawfully disclosed. Therefore, in our judgment, when deciding whether disclosure occurred, more weight ought to have been placed on these contemporaneous emails. In particular, a fair reading of the email of 2 August 2014 can only be consistent with the Person Bound having already sent the Prosecution Bundle to Mr. & Mrs. D.

107. The lack of evidence showing (i) the transmission of the Prosecution Bundle from the Person Bound to Mr. & Mrs. D; and (ii) that the Prosecution Bundle had been adduced into evidence in the London Action, does not necessarily mean that the Prosecution Bundle had not been disclosed to Mr. & Mrs. D. It may well have been transmitted via another email or other means, the evidence of which is not before this Board.

108. In such circumstances, it was, in our judgment, more likely than not that the Person Bound disclosed the Prosecution Bundle to Mr. & Mrs. D.  We therefore find that such disclosure did occur.”

54.  On the issue of the applicant giving her consent for the disclosure, the AAB made the following findings:

“112. There is no direct evidence on the purpose for which the Prosecution Bundle was supplied to the Person Bound. It was no doubt supplied to the Person Bound for the purpose of obtaining legal assistance, as demonstrated by the Person Bound’s 31 March 2014 email. But, in our judgment, obtaining legal assistance was not the sole purpose for which the Bundle was supplied to the Person Bound.

113. At or around this time and in the months preceding it, the Person Bound was, in the Appellant’s own words, assisting the Appellant with a number of other issues as well, such as obtaining medical assistance in relation to the Appellant’s mental health issues; finding housing for the Appellant and her son; and caring for her son, including how to educate him. In our judgment, it is apparent that the Bundle was supplied in the context of the Appellant seeking assistance generally from the Person Bound, and was not limited to any specific issue. The assistance the Appellant sought from the Person Bound extended to general livelihood issues, including that of raising her son and ensuring her son’s welfare and interests were safeguarded. Indeed, the Person Bound’s decision to personally shelter the Appellant and her son, and not merely to arrange pro bono legal services for the Appellant, was and is demonstrative of the type of assistance that was provided and the kind of relationship that existed between them at the time.

114. We are therefore of the view that the Person Bound’s subsequent disclosure of the Timeline of Events and the Prosecution Bundle to Mr. & Mrs. D was in the name of safeguarding the Appellant’s son’s welfare and was not done with a new purpose in mind, but within the scope of the original purpose. The contemporaneous emails demonstrate a clear concern for the Appellant’s son, and, rightly or wrongly, the view that return of the Appellant’s son to the Appellant’s care and control was not in his best interests.

115. There being no new purpose for which the Prosecution Bundle and Timeline of Events were disclosed, the issue of prescribed consent does not arise and the matter, in our judgment, ends there.

116. That should be sufficient to dispose of this appeal, but as parties have made submissions on the remaining issues and as the remaining issues were dealt with in the Decision, we will set out our views on the remaining issues as well.”

55.  Having disposed of the appeal on the basis that no prescribed consent arose because the personal data had been disclosed within the scope of the original purpose, the AAB nevertheless went on to address the issue of consent and also the exemption under section 58(2) of the Ordinance.  On that issue, the AAB provided the following analysis and conclusion. 

“121. In the present case, the words used under s. 58(1)(d) are ‘the prevention, preclusion or remedying (including punishment) of unlawful or seriously improper conduct, or dishonesty or malpractice, by persons’. In Tse Lai Yin v Incorporated Owners of Albert House [1999] 1 HKC 386 at 393D-E, Suffiad J held that ‘unlawful or seriously improper conduct’ extended beyond criminal conduct to include civil wrongs. With this, we would agree.

122. As for the context and purpose, we would agree with Mr. Brown’s submission that the exemptions catered for in the PDPO, including the Exemption, seek to prevent people from hiding behind their right to privacy whilst another wrong occurs. In other words, the PDPO’s exemptions ensure the right to privacy does not override the interests of justice.

123. On the basis, therefore, the Exemption in our judgment is engaged not only where there has been unlawful or seriously improper conduct on the part of a data subject, but also where a party seeks to defend an allegation of unlawful or seriously improper conduct. If a party has been charged with a criminal offence or accused of a civil wrong, that party ought to have at its disposal all relevant information, including personal data that may be protected by DPP 3, to conduct its defence and to remedy the situation. That is what the interests of justice would demand and require. To have it otherwise would be to elevate a date subject’s right to privacy above all other considerations, a situation which we do not think the PDPO intended for.

124. In the present case, Mr. and Mrs. D had been accused of wrongful retention, a civil wrong. They therefore ought to have had and indeed did have at their disposal all relevant information to conduct their defence, which would have included the Prosecution Bundle and the Timeline of Events. Such information would have been relevant to justifying and/or explaining their retention of the Appellant’s son in the United Kingdom.

125. In our judgment, therefore, the Exemption applies in the present cased in any event so as to relieve the Person Bound of any potential liability under the PDPO.”

56.  The basis of the AAB’s decision is as set out in paragraph 114 which I find was a conclusion open to the AAB to make in the circumstances of this case.  As far as I can ascertain, the applicant’s submissions in relation to the decision of the AAB on the exemption of “serious improper conduct” is an attempt to reargue the point based on additional information and material.  In any event, it matters not, because the AAB’s decision rested on its conclusion in paragraph 114 and the reasoning and explanations supporting it cannot be criticised.

57.  The applicant in her submission seeks to compare the findings of the first AAB Decision with second AAB Decision on the issue as to whether the Person Bound received the Prosecution Bundle and challenges the correctness of the first AAB Decision.  The AAB in the present judicial review was aware of the previous decision of the AAB, and even if there were differences in their findings of fact, that may be due to the nature of the materials and arguments before AAB in question.  In any event, the present judicial review is concerned with a challenge to the second AAB Decision on the grounds of review as articulated in the applicant’s application.

58.  The applicant complains at length that the Person Bound gave conflicting and changing reasons as to why she released the applicant’s data and sets out a series of matters in relation to the Person Bound’s account of events which were all before the AAB.

59.  The AAB noted that the applicant’s complaint alleged that the Person Bound disclosed the applicant’s personal data, as contained in the Prosecution Bundle and Timeline of Events to the applicant’s parents and the applicant’s clients between June and September 2014 without the applicant’s consent.  Although, as already noted the applicant did not pursue her complaint in relation to her clients.[10]

60.  It is clear from the AAB’s decision that they were aware of the issues as raised in the present judicial review, particularly the challenge by the applicant to the Person Bound’s account as to what had happened.  There was an issue taken by the Person Bound as to whether the Prosecution Bundle was provided by her to the applicant’s parents, although the Person Bound did acknowledge that she gave a document that she had drafted, referred to as a Timeline of Events, to the applicant’s parents.  The matter was addressed by the AAB and it concluded that the Person Bound had disclosed the Prosecution Bundle and the Timeline of Events to the applicant’s parents.

61.  The applicant highlighted the position taken on the facts by the Person Bound and that the AAB had acted unreasonably in considering this evidence.  There is no substance to this complaint whatsoever.  This is yet again an instance where the applicant simply disagrees with the way the AAB has considered the evidence and the findings that it has made when it was clearly open to it to do so.  It is not a case of the AAB acting unreasonably, contrary to public law principles. 

62.  The applicant was reminded repeatedly throughout the oral hearing that judicial review proceedings were not an appeal on the merits of the case.  When it was pointed out that she was dealing with the AAB’s findings of fact, she would resort to asserting that the AAB should have made the findings of fact as submitted by her or that the AAB did not consider the evidence correctly. 

63.  It is highly significant, that the AAB reasoned its decision on the basis that the disclosure by the Person Bound of the applicant’s personal data to her parents was within the scope of the original purpose to which the applicant agreed it could be used and therefore did not contravene DPP 3.  This in my view was a valid and proper decision for the AAB to make in the circumstances of the case and it was open for it to do so.  In essence, this is the crucial feature of the AAB’s decision and after a thorough analysis of the evidence and arguments it came to this conclusion, and it cannot be said that it was unreasonable or irrational.

Conclusion

64.  I am satisfied after an extensive review of the case and the reasoned decision of the AAB, that the matters the applicant complains about have been properly considered and dealt with as required by law. 

65.  The applicant’s complaint amounts to no more than she does not agree with the decision of the AAB, but that is not a basis for judicial review.  It was open to the AAB to decide the issues as it did and make the findings that it made.  It cannot be said that the decision offends the principles of public law or fairness.  As I have already stated, I am of the view that the application is not reasonably arguable and is therefore refused.