張煥堯 v. 商務及經濟發展局 AND OTHERS

HCAL 805/2023

[2024] HKCFI 591

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CONSTITUTIONAL AND ADMINISTRATIVE LAW LIST NO 805 OF 2023

________________________

________________

_________________

D E C I S I O N

_________________

A.  Introduction

1.  By these proceedings, the Applicant seeks leave to apply for judicial review to challenge the regime introduced by the Telecommunications (Registration of SIM Cards) Regulation Cap 106AI (“Regulation”). It is appropriate that I record up front that I accept that the Applicant is wholly motivated by a desire in the public interest to correct or mitigate what he genuinely considers to be flaws in the Regulation.

2.  Though given notice of the hearing and sight of the application papers, the Department of Justice informed the Court that the putative respondents did not intend to attend the oral hearing to make any representations (unless the Court otherwise directed, which it did not).

3.  The date of the hearing was adjourned on a few occasions at the request of the Applicant, for reasons including his desire to seek to obtain Legal Aid (which was later refused). Ultimately, I heard the ex parte oral application for leave on 23 February 2024, at the end of which hearing I reserved my Decision to be handed down later.

4.  This is my Decision.

B.  Background to the Regulation

5.  Not all of the following information was provided by the Applicant together with his application. However, it is all publicly available. The background helps with providing the appropriate context for consideration of the application.

6.  The Regulation is subsidiary legislation to the Telecommunications Ordinance Cap 106 (“Ordinance”). The Regulation had a commencement date of 1 March 2022 (though the operative deadlines set for registration were effectively a year later), and it came into being following a consultation process conducted by the Commerce and Economic Development Bureau (“CEDB”) of the Hong Kong Government.

7.  In January 2021, the CEBD issued a consultation paper to seek the views of members of the public, the telecommunications industry and other stakeholders on a proposed real-name registration programme for subscriber identity module (SIM) cards. The consultation paper comprised four chapters, being: (1) Mobile Services in Hong Kong; (2) Need for Regulation of Pre-paid SIM Cards; (3) Proposed Real-name Registration Programme; and (4) Summary.

8.  As was pointed out in Chapter 1, there are generally two major types of mobile service subscriptions offered for users in Hong Kong namely SIM service plans (“SSPs”) and pre-paid SIM (“PPS”) cards:

(1)  SSPs are largely subscription plans under which users enter into contractual agreements with the mobile service providers to obtain telecommunications services, generally committing to a specified minimum service period, and normally paid on a monthly basis according to the service package subscribed and actual usage. Operators ordinarily require users to provide personal particulars (such as name, identity document number, date of birth, etc) for regular billing and customer service purposes.

(2)  PPS services generally operate on a pay-as-you-go basis, without any fixed-term contract with the mobile service provider. There is no requirement for the operator to register personal particulars of the PPS users for use of service, which is available immediately upon purchase after following simple setup procedures. PPS services are popular because of flexibility and convenience, particularly for those who do not wish to be bound by a fixed-term monthly plan or service package. As a result, by August 2020, circulation of PPS cards had almost doubled over a decade to some 11.7 million (being 56% of overall subscribers).

9.  In identifying the suggested need for the proposed Regulation, Chapter 2 included the following:

(1)  The anonymous nature of PPS cards has been exploited by criminals in committing serious and organised crimes, such as telephone scams, human smuggling, home-made bombs, drug trafficking, syndicated burglary, technology crime, terrorist activities, immigration-related racketeering, etc.

(2)  Anonymous PPS cards enable criminals to conceal their real identity and evade detection.

(3)  Amongst the many victims have been people in vulnerable groups, in particular the elderly and retirees or those who are less familiar with the use of technology who are particularly at risk.

(4)  The prevalence of telephone deception cases making use of anonymous PPS cards have caused inconvenience and anxiety among the public towards telephone calls from unknown telephone numbers, and may affect public confidence in the telecommunication services in Hong Kong.

(5)  PPS cards have been extensively used in different kinds of deception cases.

(6)  There is a genuine need to take effective action to deter such abuse.

(7)  Further, the anonymous nature of PPS services undermines people’s confidence in the integrity of telecommunications services, jeopardises genuine and legitimate use of telecommunications services and creates obstacles for law enforcement.

(8)  From the regulatory perspective, there is no strong justification to apply less stringent registration requirements on SSP as compared to PPS services, and a regulatory imbalance would allow creating a loophole or result in possible circumvention.

(9)  Hence, a real-name registration programme covering both PPS and SSP users would strike a balance between prevention of SIM card abuses and protection of privacy and freedom of communication.

(10)  Many other jurisdictions – some 155 jurisdictions globally – have put in place a registration system for SIM cards to enhance telecommunications services and curb terrorist and serious crimes.

(11)  This identifies real-name registration as a common practice in fact, for both PPS and SSP users.

(12)  It is also not uncommon for there to be a cap on maximum number of PPS cards registrable.

10.  The proposed real-name registration programme was summarised in Chapter 3. Chapter 4 recapitulated the specific numbered proposals – 1 to 9 – by way of summary. It is convenient to set out those proposals below (italics and bold in original):

Registration of Personal Particulars (para 3.2 to 3.7)
1.	SIM card users should provide the following information as set out in their identity document, together with its copy, for registration – •  name in Chinese and English (as applicable); •  identity document number (HKID number or serial number of other acceptable identity documents such as travel documents for visitors); •  copy of identity document; and •  date of birth. A company or corporation can be registered as a PPS user if it can provide business registration information and designate a person (with provision of his or her personal particulars listed above) as representative or responsible person for the company/corporate user.
2.	Each user (including company/corporate user) can register no more than three PPS cards with each licensee.
3.	Registration of an SSP or PPS user below the age of 16 (young person) should be endorsed by an “appropriate adult” who may be the parent, relative or guardian of the young person or someone who has experience in dealing with the young person having special needs (e.g. a registered social worker).
Licensee’s Responsibility (para 3.8 to 3.10)
4.	Licensees should check, clarify and verify the information provided by users, and to deregister the concerned SIM cards if there is reasonable ground to believe that the information provided is false, misleading or incomplete.
5.	The personal information of the registered SIM card users should be kept and stored by respective licensees (including MNOs, MVNOs and CLOTS licensees) offering the relevant SIM services for at least 12 months after the SIM cards are deregistered.
Phased Implementation (para 3.11 to 3.13)
6.	The real-name registration programme will be implemented in two phases. In the first phase, licensees should put in place a registration system with a database ready within the 120 days after the date of commencement of the Regulation. On the 121st day, i.e. the Registration Day, all new PPS cards that are available for sale in the market as well as new SSPs effective from this day will need to comply with the real-name registration requirements before service activation.
7.	Licensees should not be required to re-register their existing SSP customers but should be required to ensure compliance with the real-name registration requirements upon commencement of new contracts or renewal of existing contracts.
Request for Information from Licensees (para 3.14)
8.	LEAs can request licensees to provide SIM cards registration records pursuant to a warrant issued by a magistrate or without warrant in certain urgent or emergency situations.
Sanctions (para 3.15 to 3.17)
9.	The existing sanctions such as those mentioned in paragraph 3.15 above (including financial penalties imposed by the CA on licensees) should be applied to all licensees in enforcing the real-name registration programme.

11.  In the subsequent Legislative Council Brief dated 1 June 2021, reference was made to the public consultation exercise. The Brief noted that over 20 meetings had been conducted with political parties, mobile network operators, telecommunications licensees, industry and trade organisations, innovation and technology bodies and other business sectors which extensively use mobile services in their operations. There had also been separate consultation with the Communications Authority (“CA”), the Office of the Privacy Commissioner for Personal Data (“PCPD”), the Competition Commission, the Consumer Council and the Legislative Council Panel on Information Technology and Broadcasting.

12.  The Brief stated that all stakeholders were generally supportive of or did not have objection to the real-name registration programme. But it also noted that quite a large number of stakeholders expressed concerns over specific proposals, in particular the proposed cap on PPS cards, the transitional periods and other operational issues. Having studied the feedback received and having considered the concerns to be valid and legitimate, refinements had been proposed as essential and useful to preserve the goodwill and cooperative spirit of various sectors towards the registration programme, to ensure smooth implementation of the key proposals as well is to achieve the policy objective.

13.  As stated, one of the stakeholders which made a submission in response to the consultation paper was the Office of the PCPD. Its submission paper canvassed matters which it considered to be of particular relevance, including as regards: data collection; copy of identity document; data retention duration; use of data for investigation or prevention of crimes; data security; openness and transparency; and data access and correction.

C.  The Regulation

14.  The Regulation comprises six Parts and a Schedule, being:

(1)  Part 1: Preliminary

(2)  Part 2: Registration

(3)  Part 3: Deregistration

(4)  Part 4: Record-keeping

(5)  Part 5: Miscellaneous

(6)  Part 6: Transitional Arrangements

(7)  Schedule: Specified Information of Eligible Persons.

15.  In essence, Part 2 requires specified licensee service providers who supply or will supply a service through a SIM card to ensure that the SIM card is not active unless it is currently registered with the licensee, and how the relevant registration is to be made (including by the provision as to all the specified information as to the eligible person obtaining the SIM card). There is also the imposition of a cap on or maximum number of PPS cards for different types of eligible person.

16.  Part 4 imposes on the specified licensee a duty to keep a record in respect of a SIM card during the period in which that card is currently registered for an eligible person and for a further period of one year thereafter. The record must contain the identifier of the SIM card (such as the mobile phone number assigned to it) and the current specified information of the eligible person.

17.  Relevantly for the purpose of part of the Applicant’s submissions (see below) are sections 12 and 13 in Part 4, which relate to the provision of SIM card record to law enforcement officers under warrant or not under warrant respectively. Those two sections provide as follows:

12. Provision of SIM card record to law enforcement officer under warrant

(1) If a magistrate is satisfied by information on oath that —

(a) there is reasonable cause to suspect that an offence has been, is being, or is about to be committed, and it is necessary to obtain a SIM card record for the purpose of investigating or preventing the offence; or

(b) it is necessary to obtain a SIM card record for the purpose of preventing loss of life of, or serious bodily harm to, any person,

the magistrate may issue a warrant authorizing any law enforcement officer to require the specified licensee that keeps the record to provide the record.

(2) The specified licensee must provide the SIM card record in compliance with the warrant.

13. Provision of SIM card record to law enforcement officer not under warrant

(1) If a law enforcement officer of a senior rank is satisfied —

(a) that —

(i) there is reasonable cause to suspect that a serious offence has been, is being, or is about to be committed, and it is necessary to obtain a SIM card record for the purpose of investigating or preventing the offence; or

(ii) it is necessary to obtain a SIM card record for the purpose of preventing loss of life of, or serious bodily harm to, any person; and

(b) that —

(i) a delay caused by an application for a warrant under section 12(1) is likely to defeat the purpose of obtaining the record mentioned in paragraph (a); or

(ii) for any reason it is not reasonably practicable to make such an application,

the officer may authorize in writing any law enforcement officer to require the specified licensee that keeps the record to provide the record.

(2) The specified licensee must provide the SIM card record as soon as practicable after being required to do so by a law enforcement officer authorized under subsection (1).

(3) In this section —

senior rank (高級) means a rank not below the rank of —

(a) in relation to an officer of the Customs and Excise Department—Superintendent of the Customs and Excise Service or Principal Trade Controls Officer;

(b) in relation to an officer of the Hong Kong Police Force—Superintendent of Police;

(c) in relation to an officer of the Immigration Department—Assistant Principal Immigration Officer; or

(d) in relation to an officer of the Independent Commission Against Corruption—Commission Against Corruption Officer (Upper);

serious offence (嚴重罪行) means an offence punishable by a maximum penalty that is or includes —

(a) a term of imprisonment of not less than 3 years; or

(b) a fine of not less than $1,000,000.

18.  Part 5 permits the CA to issue guidelines on how specified licensees collect and verify an eligible person’s specified information, register or deregister a SIM card, keep or provide a SIM card record under Part 4, and carry out the transitional arrangements provided for in Part 6. Part 5 also permits the CA to conduct particular inspection to identify compliance with the Regulation, and verify that the specified licensees are complying with the Regulation.

D.  The Intended Challenge

19.  The Applicant’s Form 86 was dated 23 May 2023, and supported by various materials which have been added to and/or amended in the period since. In the original Form 86, the Applicant stated that since the Regulation involves public interest, and the public are entitled to basic rights and the principle of proportionality, and there is bias in the content of the Regulation, anonymity does not necessarily denote a criminal intent or motive, and it can be taken positively and has its value of existence. The Applicant offered five justifications or grounds on which relief might be sought being, broadly:

(1)  Regarding anonymity, it is of important value in dealing with crimes, such as making a report and about witnesses.

(2)  According to information, there are five mobile network service providers at present, and all of them are indirectly involved in business related to works of real estate as well. For those engaged in businesses related to works of real estate, whether there would be interference upon the reporting of any relevant crime is not something that can be completely precluded.

(3)  In some cases, there is social impact on the revelation of the identity of the person concerned such that the person concerned becomes afraid of making report and testifying or will be unwilling to do so.

(4)  For the serious crimes mentioned in the consultation paper not only is there no direct connection, on the contrary if any serious crimes referred to are involved, the punishment imposed after trial will be severe and much heavier than the sentence received by the person concerned for obtaining valid phones or SIM cards by other unlawful means. Hence, the mandatory registration of SIM cards by the public before use cannot prevent crimes effectively. Instead, it hinders the reporting and prevention of crimes.

(5)  The Government is going to promote further use of online or electronic platforms for making enquiries, giving opinions, lodging complaints and reporting information on the Internet. The use of data networks anonymously would be more important in future, such as in the prevention of crimes and bribery.

20.  In addition to the written materials, the Applicant made careful and courteous submissions during the hearing, which to some extent elaborated or put emphasis on certain aspects of the written materials.

21.  Taking the Form 86, the written materials and the oral submissions together, it seems to me that the Applicant has essentially put forward the following arguments:

(1)  The Applicant does not suggest that he would want “to fully throw away” the Regulation. Rather, he seeks to make the Regulation, which has some flaws, somewhat better.

(2)  There are competing public interests in (a) the prevention, detection and investigation of crime, and (b) the rights to privacy and anonymity of mobile device users. But the Regulation has struck the wrong balance between those interests.

(3)  In fact, the Regulation cannot protect members of the general public and does not pay regard to prevention of crime.

(4)  There are other and better ways of achieving the stated aim.

(5)  For existing SIM cards, there should be a reasonable period before completion of registration, or a citizen who buys a PPS might be asked to produce a certificate of no criminal conviction as proof of a good citizen who has no intent to commit crimes.

(6)  The suggestion that the person who is unwilling to reveal his/her identity is not credible is not correct. On the contrary, these people are actually vulnerable groups who are unable to put up any resistance against those in power.

(7)  Ordinary citizens who have committed no crimes should not be treated as though they are persons who have committed serious crime.

(8)  The loss of anonymity hinders the reporting and preventions of crimes, where persons may be deterred from reporting crime for fear of their personal particulars being made available.

(9)  Where various government departments stressed that information provided to them will be kept strictly confidential, it is of great importance to protect the identity of an anonymous person/complainant.

(10)  The overall crimes in the period from 2021 to 2023 show a clear increase in number, whilst the detection rate has dropped. Therefore, real-name registration for SIM cards cannot achieve the purpose of fighting crime effectively.

(11)  Further, a number of the crimes specifically mentioned in the consultation paper are not directly connected with the use of SIM cards.

(12)  Information from suicide prevention organisations shows that citizens find it easier to confide in someone and to express themselves online. Therefore, it is very important to allow citizens to use mobile data anonymously. The number of suicides far outnumbers the so-called extremely serious cases of crime, even during the consultation period.

(13)  The fact that a person does not seek assistance does not mean that he or she does not need assistance and support or someone to confide in. Hence the important need for anonymity.

(14)  In respect of relevant records, the right to privacy is protected by common law, where personal data and data records belong to the users rather than the non-service providers.

(15)  Personal data breaches in a number of large-scale organisations have arisen due to either system failure or human factors. The private telecommunications companies cannot provide a 100% guarantee that the data of citizens in the data bank will not be breached because of similar problems.

(16)  The most direct way to protect data is to provide no data at all to someone who cannot give a 100% guarantee to protect it.

(17)  The leaking of data from private telecommunications companies could itself lead to other types of serious crime. Hence, far from hindering crime, it may lead to more crime and more circumvention situations.

(18)  As regards Part 4 of the Regulation, there should be a requirement that a person whose data is provided to a law enforcement authority should be informed of that fact as soon as possible. Any person whose data has been provided pursuant to a warrant, or even without a warrant, should note the existence of the warrant or provision of data.

(19)  The Regulation is inconsistent with, or contradictory to, a number of provisions in other ordinances – or the relevant protections are available by using the powers in other ordinances.

(20)  Maintaining anonymity is lawful. But the Regulation may cause people not to report crime anonymously or to seek help.

22.  The Applicant also stated that he wanted to obtain the name list relating to the 20 meetings said to have been conducted in the consultation exercise (see above) or at least that the material should be kept.

23.  I note that there is no constitutional challenge to the Regulation. As already stated, the Applicant himself does not suggest that the Regulation needs to be “fully thrown away”, but merely that it could be improved or amended to strike the right balance.

E.  Are There Merits for Grant of Leave?

24.  With respect to the Applicant, I do not think his arguments give rise to any reasonably arguable public law grounds of judicial review with any reasonable prospect of success.

25.  The nature of the points made by the Applicant is of points which might have been raised, or which perhaps were raised, and (in some instances) which certainly were raised during the consultation process prior to the making of the Regulation. The views expressed by the Applicant may reasonably be held by him, and a number of other people.

26.  However, as the Applicant has himself recognised, there was a balancing exercise to have been conducted. Whilst he has suggested that the real-name registration provided for in the Regulation is not effective in preventing crime, it cannot realistically be doubted that it might at least assist in investigating crime and there may be some deterrent effect. To some extent, it may have direct impact on the prevention of crime. It is by no means illogical to think that removing anonymity from the use of a mobile device may discourage the use of such a device in the commission of crime.

27.  Similarly, whilst it may be correct that some persons will show greater reluctance to report certain crime, or perhaps to seek assistance in situation of personal difficulty or trauma, if they cannot do so entirely anonymously, that is a factor to be balanced against the perceived benefits of the real-name registration programme as mandated in the Regulation.

28.  That balancing exercise is one for the executive or legislature (not one for the Court) to conduct, and unless it has been conducted obviously Wednesbury unreasonably – which I do not accept – there is no reasonable basis for the Court to interfere.

29.  It is also right to point out that that opinions or comments affecting the proposed real-name registration programme probably could and should have been offered during the consultation process, to be weighed in the balance, rather than subsequently using judicial review proceedings as a forum to express those views.

30.  Further, it is not the role of the Court exercising its supervisory judicial review jurisdiction to engage in drafting or re-drafting of sub-legislation. To suggest that some amendments might be made so as to “improve” the Regulation, or in some way to alter the existing balance effected by the Regulation, does not seem to me to identify any reasonably arguable public ground of review of the Regulation.

31.  Though not necessarily determinative, I can also mention that there is a problem of delay in this case. As noted above, the commencement date for the Regulation was 1 March 2022. Even if its actual operation was in effect not until around February 2023, the terms of the Regulation – and the real-name registration program thereby implemented – were clear and in place in March 2022. It is trite that an application for leave to apply for judicial review should be brought as soon as possible, and in any event within three months of the date of the matter in respect of which relief is sought. In my view, time for bringing the application expired at the end of June 2022 (unless an extension of time was to have been sought and granted). The Applicant appears to think that he brought his application within the deadline, if time ran from 23 February 2023. But, as I say, I think the time for bringing an application actually ran from almost one year earlier.

32.  There is no application for an extension of time, and in any event I do not think there would be circumstances as would justify the extension if sought. The way in which the real-name registration programme was to be implemented was clear, and followed the consultation process I have set out above. Whilst it is correct that the Applicant has placed some reliance on matters which have occurred since March 2022, including when the Regulation became fully operative in February 2023, I do not think those matters alone justify the necessary extension of time.

F.  Result

33.  In the circumstances, I dismiss the application for leave to apply for judicial review.

34.  The Applicant sought to impress upon me that in any event he should not bear any costs for having made this application. He will not. First, I have already accepted the genuine motivation in bringing the application to Court, might be relevant in the discretionary mix as to costs. Secondly, and in any event, no other party has incurred (or sought) costs, where the application has been dealt with on the ex parte basis.

35.  In conclusion, I dismiss the application with no order as to costs.