G AND OTHERS v. MR LAM, KUI-PO, WILLIAM, DEPUTY CHAIRPERSON OF THE TORTURE CLAIMS APPEAL BOARD / NON-REFOULEMENT CLAIMS PETITION OFFICE AND OTHERS

HCAL 316/2019

[2020] HKCFI 377

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CONSTITUTIONAL AND ADMINISTRATIVE LAW LIST NO 316 OF 2019

________________________

________________________

________________________

J U D G M E N T

________________________

BACKGROUND FACTS

1.  This is the rolled-up hearing of an application for judicial review by 8 Applicants, who are non-refoulement claimants, in somewhat unusual circumstances.  The 8 Applicants’ non-refoulement claims were refused by the Director of Immigration (“the Director”) at first instance, and they appealed the decisions of the Director to the Torture Claims Appeal Board/Non-refoulement Claims Petition Office (hereinafter referred to as “the Board” or “the 3^rd Respondent”).  Their appeals were originally assigned to the Deputy Chairman of the Board (“the 1^st Respondent”) for determination.

2.  The appeals of the 8 Applicants have reached different stages, as follows:

(1)     The 1^st to 3^rd Applicants -

(a)     in so far as their non-refoulement claims were based on torture risk, persecution risk and/or BOR 3 risk, their appeals were heard and determined by the 1^st Respondent and the relevant decisions dismissing their appeals were given on 30 September 2015, 15 December 2016 and 23 December 2016 respectively (collectively “the Issued Decisions”);

(b)     in so far as their non-refoulement claims were based on BOR 2 risk -

(i)     the 1^st and 2^nd Applicants’ appeals have not yet been heard or determined; and

(ii)     the 3^rd Applicant’s appeal was heard by the 1^st Respondent on 5 October 2018, but the 1^st Respondent has not yet given his decision on that appeal.

(2)     The 4^th to 6^th Applicants - their appeals in respect of the rejection of their non-refoulement claims based on all applicable grounds were heard by the 1^st Respondent on 12 September 2018, 5 September 2018 and 6 September 2018 respectively, but the 1^st Respondent has not yet given his decisions on those appeals.

(3)     The 7^th and 8^th Applicants - their appeals in respect of the rejection of their non-refoulement claims based on all applicable grounds have not yet been heard or determined.

3.  On 14 September 2018, the Board issued a press release (“Press Release”) relating to an incident involving the loss of a laptop computer of a Board member[1] (“the Incident”).  The Press Release stated, inter alia, the following:

“A spokesman for the Torture Claims Appeal Board (the Appeal Board) said today (September 14) that a personal laptop of a Board member was suspected of being stolen overseas. The member has reported the incident to the local police force. As the computer concerned contains personal data of some appellants of non-refoulement claims, the Appeal Board has submitted a data breach notification to report the incident to the Office of the Privacy Commissioner for Personal Data (PCPD).

‘According to the Appeal Board’s preliminary assessment, the incident involved the personal data of about 30 appellants who are pending hearing, and decisions which the Appeal Board already made and served on other appellants, which were stored in the laptop. The personal data include the names and nationalities of the appellants. The lost laptop does not contain other personal data of appellants,’ the spokesman said.

…

‘The Appeal Board has reported the incident to the Security Bureau (SB), and will submit a detailed report on the incident within two weeks as per SB’s request…’”

4.  On 17 September 2018, the Board sent to each of the Applicants a letter informing him/her of the Incident which, it was stated, might have led to the loss of his/her personal data (name and nationality only).

5.  By a letter dated 8 October 2018, the Administrator of the Duty Lawyer Scheme (“the Administrator”) wrote to the Chairperson of the Board (“the 2^nd Respondent”) requesting, inter alia, (i) for a copy of the Report to the Security Bureau (“the SB Report”) referred to in the Press Release, and (ii) that the appeals of the affected non-refoulement claimants be “heard completely de novo by another TCAB member”.

6.  By letters dated 15 October 2018, the 2^nd Respondent issued the following orders or directions in relation to:

(1)     the 1^st Applicant’s appeal - the forthcoming hearing on 30 November 2018 would take place as scheduled before a new Board Member/Adjudicator;

(2)     the 2^nd Applicant’s appeal - the forthcoming hearing on 26 October 2018 would take place as scheduled before a new Board Member/Adjudicator;

(3)     the 3^rd Applicant’s appeal - the hearing which had taken place on 5 October 2018 before the 1^st Respondent had been superseded by unforeseen events beyond the control of the Board, and the appeal would be heard de novo by a new Board Member/Adjudicator;

(4)     the 4^th Applicant’s appeal - the hearing which had taken place on 12 September 2018 before the 1^st Respondent had been superseded by unforeseen events beyond the control of the Board, and the appeal would be heard de novo by a new Board Member/Adjudicator;

(5)     the 5^th Applicant’s appeal - the hearing which had taken place on 5 September 2018 before the 1^st Respondent had been superseded by unforeseen events beyond the control of the Board, and the appeal would be heard de novo by a new Board Member/Adjudicator;

(6)     the 6^th Applicant’s appeal - the hearing which had taken place on 6 September 2018 before the 1^st Respondent had been superseded by unforeseen events beyond the control of the Board, and the appeal would be heard de novo by a new Board Member/Adjudicator;

(7)     the 7^th Applicant’s appeal - his appeal, which was scheduled for hearing before the 1^st Respondent on 11 October 2018, would be heard de novo by a new Board Member/Adjudicator on a date to be fixed;

(8)     the 8^th Applicant’s appeal - the forthcoming hearing on 27 November 2018 would take place as scheduled before a new Board Member/Adjudicator.

7.  By letters dated 23 October 2018, the 2^nd Respondent issued the following further orders or directions in relation to:

(1)     the 1^st Applicant’s appeal - the Issued Decision dated 30 September 2015 had been superseded, and his non-refoulement claims on all applicable grounds would be heard de novo by a new Board Member/Adjudicator;

(2)     the 2^nd Applicant’s appeal - the Issued Decision dated 15 December 2016 had been superseded, and his non-refoulement claims on all applicable grounds would be heard de novo by a new Board Member/Adjudicator;

(3)     the 3^rd Applicant’s appeal - the Issued Decision dated 23 December 2016 had been superseded, and his non-refoulement claims on all applicable grounds would be heard de novo by a new Board Member/Adjudicator; and

(4)     the 4^th Applicant’s appeal - reiterating that the hearing which had taken place on 12 September 2018 before the 1^st Respondent had been superseded by unforeseen events beyond the control of the Board, and his appeal would be heard de novo by a new Board Member/Adjudicator.

8.  On 23 October 2018, the Administrator wrote again to the 2^nd Respondent stating that leading counsel had advised the affected non-refoulement claimants to apply for adjournment of pending hearings before the Board on the basis that they required to see the SB Report in order to be able to advance their appeals in accordance with the highest standards of fairness, and asking her to address their “grave concern”.

9.  On 24 October 2018, the 2^nd Respondent replied to the Administrator stating, inter alia, that (i) details of the Incident and the personal data involved had already been set out in the Press Release, (ii) the SB Report did not contain details of individual appellants/petitioners and their non-refoulement claims, and (iii) the de novo hearings of the relevant appeals by the Board would be conducted as scheduled.

10.  There was further correspondence exchanged between the Board and the Applicants concerning the question of disclosure of the SB Report and whether the scheduled de novo hearings of their appeals should be adjourned pending the disclosure of the same.  In particular:

(1)     By letters dated 29 October 2018 and 20 November 2019, the Board informed the 1^st Applicant that his application for adjournment of the scheduled hearing on 30 November 2018 pending the disclosure of the SB Report and other information would be dealt with at the hearing.

(2)     By a letter dated 9 November 2018, the Board informed the 8^th Applicant that his application for disclosure of the SB Report and adjournment of the scheduled hearing on 27 November 2018 pending the disclosure of the same would be dealt with at the hearing.

(3)     By a letter dated 21 November 2018, the Board informed that 3^rd Applicant that his application contained in his Duty Lawyer’s letter dated 16 November 2018 (namely, that the 3^rd Applicant should be given “time (say about 2 months) to consult, discuss and seek counsel’s opinion on the Incident” and that the Board should “withhold any actions against [him] and others who are affected by the Incident including but not limited to calling for or arranging hearings or submissions”) would be dealt with at a hearing to be fixed.

APPLICATION FOR JUDICIAL REVIEW

11.  On 1 February 2019, the Applicants made the present application for leave to apply for judicial review seeking to challenge the following decisions:

(1)     the 1^st Respondent’s action in transferring the personal data of the Applicants onto a personal laptop computer, which he subsequently lost/had stolen overseas, and his subsequent failure to take appropriate action, including the disclosure of the relevant documentation pertaining to the facts and circumstances of the lost/stolen laptop computer to the Applicants (“the 1^st Decision”);

(2)     the 2^nd Respondent’s decision setting aside the Issued Decisions and directing that de novo hearings be conducted in relation to the affected appeals which had already been determined by the Issued Decisions (“the 2^nd Decision”);

(3)     the 2^nd and 3^rd Respondents’ decision dated 24 October 2018 refusing to disclose to the Applicants documentation detailing the facts and circumstances of the 1^st Respondent’s loss of his personal laptop computer containing the personal data and confidential information of the Applicants (“the 3^rd Decision”);

(4)     the 2^nd and 3^rd Respondents’ decision dated 24 October 2018 to proceed with de novo hearings of the Applicants’ appeals without providing disclosure of the documents and information referred to at (3) above (“the 4^th Decision”); and

(5)     the 3^rd Respondent’s failure to implement any policy and procedure to secure the safe storage and transfer of personal data of non-refoulement claimants pursing appeals before the Board (“the 5^th Decision”).

12.  The Applicants’ grounds for judicial review are set out in §11 of the Form 86, as follows:

(1)     Ground 1: the Respondents’ continuing refusal to disclose to the Applicants documents and information providing, inter alia, details as to the facts and circumstances of the 1^st Respondent’s loss of his person laptop computer containing the personal data and confidential information of the Applicants is procedurally unfair and/or Wednesbury unreasonable;

(2)     Ground 2: the 2^nd and 3^rd Respondents’ decision to conduct and proceed with de novo hearings without providing relevant disclosure as to the documents and information referred to above in (1) above is procedurally unfair and/or Wednesbury unreasonable;

(3)     Ground 3: the 2^nd Respondent’s decision to set aside the Issued Decisions reached by the 1^st Respondent under Section 16 of Schedule 1A of the Immigration Ordinance, Cap 115 (“the Ordinance”), and directing de novo hearings in respect of the affected appeals is ultra vires;

(4)     Ground 4: the Respondents’ failure to implement any policy and procedure to secure the safe transfer of personal data of non-refoulement claimants pursuing appeals before the Board, and/or their failure to comply and/or ensure compliance with such policy and procedure, are Wednesbury unreasonable.

13.  On 12 February 2019, the court directed a rolled-up hearing of the application for leave to apply for judicial review and, if leave be granted, the substantive application for judicial review.

14.  By agreement of the parties, the scheduled hearings of the Applicants’ appeals before the Board were adjourned pending the resolution of these judicial review proceedings.

THE SB REPORT

15.  Pursuant to a consent order dated 9 September 2019 made by the court following the issuance of a summons by the Applicants on 26 June 2019, a redacted copy of the SB Report dated 18 September 2018 was provided to the Applicants subject to their undertaking not to use it (including its annexes) for any collateral or ulterior purpose or disclose it to any other third parties without the Respondents’ prior written consent, and to use it only for the proper purposes of and in connection with the conduct of these proceedings.

16.  In the SB Report, the following is stated:

“The Incident

[2] A TCAB member reported the theft of his notebook computer with a microSD card at Sydney International Airport on 3 September 2018. He had reported the incident to the Australian Federal Police immediately after he discovered that his computer was missing. …

[3] The incident involved the personal data of about 30 appellants whose appeals are pending hearing/decision, and decisions which the TCAB has already made and served on the appellants, which were stored in the computer. The personal data include the names and nationalities of the appellants. The computer does not contain other personal data of the appellants.

Possible Impacts

[11] According to the TCAB member’s report (at Annex A), the only personal data in the computer are appellants’ names and their nationalities. There is no other data, e.g. date of birth, addresses, telephone numbers, nor any other data in the devices concerned. The computer was lost in a country that is not a Risk State (a country to which non-refoulement claimants claim they cannot be returned for fear of various risks). This incident does not involve data of any Hong Kong residents and is believed to be an isolated case. Considering the above, we are of the view that the suspected data breach should unlikely cause any threat to personal safety, identity theft, financial loss, humiliation or loss of dignity, damage to reputation or relationship, and loss of business and employment opportunities.

[12] Other than information of appellants of 30 impending cases, other decisions concerned have been issued to appellants… As for the 30 impending cases, possible leakage would not affect the final decision of the appeals concerned.

[13] The stolen computer is not a government property, and is not connected with any computer systems of the TCAB or the Government…

Improvement measures

[14] TCAB members can choose to work in TCAB office or places of their own choice. As they are required to handle personal data and case materials, there is a need to enhance their data security management and put in place sufficient safeguards to ensure that no information will be leaked or disclosed to unauthorized third parties inadvertently.

[15] After the incident, the Secretariat has advised all TCAB members to password-protect all files involving personal data of appellants stored in their computers. The same applies to staff of the Secretariat when they send appeal files, documents and related information to TCAB members.

[16] The Secretariat has also revived their request to ITMU for providing encrypted USBs to TCAB members for use…

[17]     In consultation with ITMU, the Secretariat will circulate applicable guidelines to raise TCAB members’ awareness on IT security.”

17.  In the 1^st Respondent’s report dated 5 September 2018 (Annex A to the SB Report), the 1^st Respondent stated, inter alia, the following -

“I reported to you yesterday the theft of my Acer notebook computer when in the departure area of Sydney International Airport in the early afternoon of Monday 03 September 2018 at about midday. I have not lost any physical files, but as there were TCAB Decisions in the computer I wish to brief you of the incident and the identities of the Decisions…

I had written Decisions inside the microSD card. Most of the Decisions have been completed and sent to the relevant Case Officers, most of which would have been issued already….

Because no physical files have been lost, the only TCAB data in the computer are the file numbers, appellants’ names, and their nationalities.  There are no other data, e.g. no dates of birth, no addresses, no telephone numbers, nor any other data.  And the computer was lost outside Hong Kong.”

18.  It further appears, from an “Information Security Incident Reporting Form” (Annex B to the SB Report), that the 1^st Respondent’s laptop computer and the relevant files are not password-protected or encrypted such that “[p]ersons who pick up the laptop computer may have access to the data kept in the computer”, and that the laptop computer has not yet been found or located.  The following discussion in this judgment shall proceed on these bases.

DISCUSSION

19.  At the rolled-up hearing on 6 December 2019, Mr Nicholas Cooney SC (for the Applicants) informed the court that the Applicants would not be pursuing any remedy in respect of the 1^st Decision.  It is, accordingly, not necessary for the court to further consider their challenge to the 1^st Decision.

(i)     Ground 1: the Respondents’ refusal to disclose documents / information is procedurally unfair and/or Wednesbury unreasonable

20.  The documents / information which the Applicants originally contended the Respondents ought to have disclosed to them immediately after the Incident were set out in §122b of the Form 86.  They included, but were are not limited to, the following:

(1)     the SB Report;

(2)     particulars as to what type of personal data was lost;

(3)     information pertaining to the country in which the laptop containing their personal data was stolen;

(4)     any published protocols, before the date of the theft, as to the security of parties’ personal data;

(5)     copies of any communications between the 1^st Respondent and any third party with regard to the loss of the laptop;

(6)     information pertaining to how the Board intended to be updated regarding the overseas police investigations, and what follow up measures had been implemented; and

(7)     a full and proper explanation on oath from the 1^st Respondent and others as to all the circumstances pertaining to the use, contents and loss of the laptop computer and requisite disclosure of all documentation including the report to the Secretary of Security, report to the insurance company (if any), report to foreign police force (if any), and all reports of the 2^nd Respondent in relation to this matter, as well as all pre-existing and current protocols in relation to laptops and prohibition on removing data.

21.  At the hearing on 6 December 2019, Mr Cooney informed the court that the Applicants would narrow down their complaints to only the first three items referred to in §20(1), (2) and (3) above (“the Requested Documents and Information”), because they were or could be relevant to subsequent claims which might be lodged by the Applicants under Section 37ZO of the Ordinance.

22.  In so far as items (1) and (3) are concerned, the Applicants have now obtained a redacted version of the SB Report, and also know the country in which the laptop computer containing their personal data was stolen.  In relation to item (2), Mr Cooney does not accept that the personal data of the Applicants which have been lost concern only their names and nationalities (as stated in the Press Release and the SB Report), and he refers to the Issued Decisions to demonstrate that other personal data of the Applicants are also likely to be contained in the computer (eg their ages, their routes of escape, the identities of the persons from whom they are fleeing, details of their allegations against the State actors, etc).  There is force in Mr Cooney’s submission, and I shall proceed on the basis that personal data of the Applicants other than their names and nationalities may have been “leaked” as a result of the 1^st Respondent’s loss of his laptop computer.

23.  In support of this ground of judicial review, Mr Cooney relies on the principles of fairness summarized by the Court of Appeal in ATV v Communications Authority (No 2) [2013] 3 HKLRD 618 at §54, in particular that “[i]t is generally unfair for the decision-maker to have access to damaging or adverse material to which the person at risk has no access” and “[t]he heart of a fair procedure and hearing is that there should be a reasonable opportunity for a person to know about and respond to adverse materials received by and relied on by the decision-maker”[2].

24.  Mr Cooney further submits that:

(1)     The Applicants require the Requested Documents and Information so that they can properly consider, and make effective and focused representations on, what additional risks (if any) arise from the loss of their personal data.

(2)     The details as to the loss of the Applicants’ personal data may contain information either favourable or prejudicial to the Applicants, and ought therefore to be disclosed.

(3)     The nature of the decision to be made by the Board is of extreme importance, and requires “high standards of procedural fairness”.

(4)     There is a strong presumption in favour of disclosure, relying on Re D (Minors) [1996] AC 593, at 615H per Lord Mustill.

(5)     The Respondents have not provided any good reasons for refusing to disclose the Requested Documents and Information.

(6)     There is no “compelling case” for non-disclosure by the Respondents.

(7)     By the belated disclosure of the SB Report (albeit in a redacted form) in these proceedings, the Respondents have impliedly acknowledged that the SB Report is indeed relevant and ought to be inspected by the court and the Applicants[3].

25.  When assessing whether the Respondents’ non-disclosure of the Requested Documents and Information is procedurally unfair and/or Wednesbury unreasonable, it is important to bear in mind that the assessment is in the context of the determination of the Applicants’ pending appeals by the Board.  The focus of the consideration is not whether the non-disclosure of the Requested Documents and Information is unfair or unreasonable in a general sense.

26.  In my view, the Respondents’ non-disclosure of the Requested Documents and Information is not procedurally unfair or Wednesbury unreasonable, for the following reasons.  First, the facts and circumstances of the loss of the laptop computer by the 1^st Respondent in September 2018 in Australia cannot in any sense be regarded as “damaging or adverse materials” to which the Applicants ought to have a reasonable opportunity to respond for the purpose of their appeals.

27.  Second, the loss of the laptop computer by the 1^st Respondent in an airport in Australia occurred in September 2018, which was after, and likely many months after, the circumstances giving rise to the Applicants’ non-refoulement claims.  In principle, whether the non-refoulement claims are well founded ought to be determined by reference to events which occurred prior to the date of the Incident.  It is difficult to see how the facts and circumstances of the loss of the laptop computer by the 1^st Respondent may assist the Applicants in establishing their non-refoulement claims.

28.  Third, when determining the appeals of the Applicants, the Board will not have to inquire into, or make any findings in relation to, the facts and circumstances of the loss of the laptop computer by the 1^st Respondent.

29.  In Minister for Immigration and Border Protection v SZSSJ and SZTZI (2016) 259 CLR 180, the Department of Immigration and Border Protection in Australia published statistics on its website which included embedded information disclosing the identities of 9,258 applicants for protection visas who were then held in immigration detention.  The disclosed personal information remained on the website for two weeks, and was accessed 123 times in that period.  This incident came to be known as “the Data Breach”.  The Data Breach resulted in a risk that people would become aware of the identities of applicants for protection visas in Australia, particularly people residing in the countries of origin from which the visa applicants feared persecution or other harm.  In response to the Data Breach, the Department commissioned an independent report from external consultants, KPMG, an abridged version of which was provided to the affected individuals.  One of the issues which arose for determination was whether procedural fairness was denied because they were not given all relevant information relating to the Data Breach and an unabridged KPMG report was not provided.  The High Court of Australia rejected the complaint, stating the following at §§80-84:

“[80] Engaging with the Full Court’s conclusion, that procedural fairness was denied because the ITOA process was inadequately explained and because the unabridged KPMG report was not provided, involves returning to some basic principles.

[81] First, it is axiomatic that a court exercising its own curial jurisdiction to review administrative action on a ground of jurisdictional error – including a jurisdictional error constituted by a failure to exercise a statutory power in a manner that complies with an implied condition of procedural fairness – does not ‘go beyond the declaration and enforcing of the law which determines the limits and governs the exercise of the repository’s power’. That is not to say that the court must proceed in a normative vacuum; but it is to say that the court can proceed only for that purpose. ‘If, in so doing, the court avoids administrative injustice or error, so be it; but the court has no jurisdiction simply to cure administrative injustice or error.’

[82] Second, compliance with an implied condition of procedural fairness requires the repository of a statutory power to adopt a procedure that is reasonable in the circumstances to afford an opportunity to be heard to a person who has an interest apt to be affected by exercise of that power. The implied condition of procedural fairness is breached, and jurisdictional error thereby occurs, if the procedure adopted so constrains the opportunity of the person to propound his or her case for a favourable exercise of the power as to amount to a ‘practical injustice’.

[83] Ordinarily, affording a reasonable opportunity to be heard in the exercise of a statutory power to conduct an inquiry requires that a person whose interest is apt to be affected be put on notice of: the nature and purpose of the inquiry; the issues to be considered in conducting the inquiry; and the nature and content of information that the repository of power undertaking the inquiry might take into account as a reason for coming to a conclusion adverse to the person. Ordinarily, there is no requirement that the person be notified of information which is in the possession of, or accessible to, the repository but which the repository has chosen not to take into account at all in the conduct of the inquiry.

[84]     Extraordinary as they are, the circumstances of the Data Breach do not warrant a departure from those ordinary requirements. That the Department was responsible for its occurrence is regrettable. That the Department was responsible for its occurrence nevertheless provides no foundation for apprehending that an officer of the Department tasked with assessing the consequences of the Data Breach for an individual applicant would not bring an impartial and unprejudiced mind to the conduct of an assessment. Nor does that circumstance provide a principled foundation for converting the ordinary requirement of procedural fairness that an affected person be given notice into a duty that the Department reveal ‘all that it knows’ about the Data Breach.”

30.  Fourth, the argument that the loss of the personal data of the Applicants contained in the 1^st Respondent’s laptop computer may give rise to “additional risks” of harm to them is premised on the scenario that their personal data, together with the fact that they have made non-refoulement claims in Hong Kong as well as the details of the allegations raised by them in support of the claims (collectively “the Information”), somehow find their way into the hands of those from whom the Applicants are fleeing (“the Authorities”) and the Applicants are removed back to their home countries (ie the relevant risk States).  Such additional risks would unlikely arise unless their non-refoulement claims are well founded, which is the very question to be determined by the Board.  In any event, even if some such additional risks may arise and are relevant to the Applicants’ appeals, since there is no practicable way of determining whether the Information has in fact reached the hands of the Authorities, in order to remove any lingering doubts of unfairness to the Applicants, the Board should simply assume, in their favour, that the Authorities have indeed gained access to the Information in some way, and determined the appeals on that basis.  This would avoid any unnecessary argument on whether the Requested Documents and Information are relevant to the appeals and ought therefore to be disclosed.

31.  In SZSSJ and SZTZI, supra, the officers who were tasked to assess the effect of the Data Breach on Australia’s non-refoulement obligations with respect to the affected applicants were instructed to assume that an applicant’s personal information might have been accessed by authorities in the country in which the applicant feared persecution or other relevant harm.  The High Court of Australia held that such assumption was sensible and removed from the scope of factual inquiry any question of precisely who accessed their personal information as a result of the Data Breach.  At §§90-92 of the judgment, the High Court of Australia stated as follows:

“[90] The assumption made in the ITOA process that their personal information may have been accessed by authorities in Bangladesh and China removed from the scope of factual inquiry any question of precisely who accessed their personal information as a result of the Data Breach. The assumption was sensible because the true extent of access to the personal information of each affected applicant must in practical terms have been unknowable. Once downloaded from the Department’s website, the document containing the personal information of the 9,258 visa applicants could have been forwarded to and interrogated by anyone, anywhere and at any time. Attempting to make a finding about precisely who had obtained access to the personal information of any one of them, and when, might be expected to have been a hopeless endeavour.

[92]     SZSSJ and SZTZI were not deprived of any opportunity to submit evidence or to make submissions relevant to the subject-matter of the ITOA process as a result of not having such further information as might be inferred to have been contained in the unabridged version of the KPMG report. Exactly how and why the Data Breach occurred was simply not relevant to the question of whether one or more of Australia's non-refoulement obligations were engaged in respect of them. And irrespective of what the unabridged KPMG report might have to say about the identities of the 104 IP addresses from which the document had been accessed during the 14 day period of the Data Breach, the fact would remain that once the document was downloaded the personal information of SZSSJ and SZTZI could have been accessed by anyone. Even if the unabridged KPMG report might have allowed SZSSJ and SZTZI to prove by reference to the report that one or more of those IP addresses were associated with persons or entities from whom they feared harm, that proof would advance their cases for engagement of Australia’s non-refoulement obligations no further than the assumption already made in their favour.”

32.  Fifth, there is no basis or ground to believe that an Applicant would be at risk of harm in the Applicant’s home country just because he/she has made a non-refoulement claim in Hong Kong.  Even if, for the sake of argument, some such risk could arise, the relevant risk would give rise to a fresh non-refoulement claim which would fall outside the scope of the existing appeal before the Board.

33.  In all, I am of the view that procedural fairness does not require the disclosure of the Requested Documents and Information to the Applicants.  That being so, it is nothing to the point that the Respondents have not provided any “good reasons”, or make out any “compelling case” for not disclosing the Requested Documents and Information sought by the Applicants.  The fact that the Respondents have consented to the disclosure of a redacted version of the SB Report in these proceedings cannot affect the question of whether they are under a duty to disclose the Requested Documents and Information to the Applicants in the first place.

34.  For the foregoing reasons, I reject the Applicants’ argument that the Respondents’ refusal to disclose the Requested Documents and Information to them is procedurally unfair or Wednesbury unreasonable.

(ii)     Ground 2: the 2^nd and 3^rd Respondents’ decision to conduct and proceed with de novo hearings without disclosing the Requested Documents and Information is procedurally unfair and/or Wednesbury unreasonable

35.  Mr Cooney accepts that this ground stands or falls together with Ground 1.  Since I have rejected Ground 1, Ground 2 is also rejected.

(iii) Ground 3: the 2^nd Respondent’s decision to set aside the Issued Decisions is ultra vires

36.  Once the Board has disposed of an appeal lodged under Section 37ZR, the relevant torture claim is finally determined.  This is the plain effect of Section 37V of the Ordinance which, so far as relevant, states as follows:

“(1) Subject to subsections (2), (3), (4) and (5), a torture claim is finally determined once a decision on the claim is made by an immigration officer under section 37ZI.

(2) For a torture claim rejected by a decision under section 37ZI(1)(b), the claim is finally determined -

(a) when the period within which an appeal may be lodged against the decision has expired (if an appeal against the decision has not been lodged within that period); or

(b)     when the appeal has been disposed of (if an appeal has been lodged against the decision).”

37.  The finality of the Board’s decision is also provided for in Section 23 of Schedule 1A to the Ordinance which, so far as relevant, states as follows:

“(1) On an appeal against a decision referred to in section 37ZR, the Appeal Board may confirm or reverse the decision.

(4) The Appeal Board’s decision is final.”

38.  The proper construction of Section 37V(2)(b) of the Ordinance was considered by the courts in Hussain Tasawar v Betty Kwan (Adjudicator) [2017] 2 HKLRD 567, and Re Ali Usman [2018] JKCA 955.

39.  In Hussain Tasawar, the claimant appealed against the decision of the Director to reject his non-refoulement claim, but he later requested to “cancel” his appeal.  After the Board had sent a letter (the Letter) to the claimant informing him that his appeal/petition had been treated as having been disposed of and consequently finally determined, the claimant gave notice of intention to reverse his withdrawal of the appeal and asked the Board to withhold his deportation.  The Board refused the claimant’s application to reinstate his appeal.  The claimant then applied for judicial review of the Board’s decision.  Rejecting the application for judicial review, Deputy High Court Judge Kent Yee held that once an appeal had been disposed of by the Board, it became functus officio, and had no power to deal with the appeal again.  At §§35 to 47 his judgment, the learned Deputy Judge stated as follows:

“[35] Section 37U provides the definitions of such terms found in Part VIIC. Section 37V is referred to for the definition of ‘finally determined’. Section 37V(1) provides that subject to the subsections, a torture claim is finally determined once a decision on the claim is made by an immigration officer under section 37ZI.

[36] Section 37V(2)(b) provides that for a torture claim rejected by a decision under section 37ZI(1)(b), as in the case of HT, the claim is finally determined when the appeal has been disposed of, if an appeal has been lodged against the decision.

[37] Thus, the issue is whether HT’s appeal has been disposed of without having been determined on its merits on account of his valid withdrawal of the same. In my view, it was disposed of by the Board when it accepted HT’s withdrawal by the Letter…

[40] Therefore, though the appeal of HT has not been determined on its merits, it was disposed of by his withdrawal of the same and it follows that HT’s claim, which was rejected at the first tier, is deemed to be finally determined within the meaning of section 37V(2).

[41] Further, once the withdrawal of HT’s appeal was accepted by the Letter, his appeal has not gone into a state of suspended animation but simply ceased to exist. Section 16 of Schedule 1A is inapplicable as the appeal is no longer pending to be heard and determined by the Board.

[42] I agree with the adjudicator that the Board cannot rely on section 16 of Schedule 1A to re-instate a validly and effectively abandoned or withdrawn appeal. The adjudicator already held the Hearing to determine the validity of the withdrawal as a matter of practice and procedure. With the claim and the validity of the withdrawal having been finally determined, I agree with the adjudicator that the Board has no further function and is functus officio.

[46] As I have concluded above, once the withdrawal of the appeal is accepted, the Board becomes functus officio. There is no basis to imply any further power to enable the Board to deal with the appeal again.

[47]     In addition, the Ordinance clearly intends that a claim is considered finally determined once its appeal has been disposed of. This is to ensure finality.”

40.  In Ali Usman, the Court of Appeal also had the occasion to consider the question of whether the functus principle applied to proceedings before the Board, and concluded that it did.  Barma JA, giving the judgment of the Court of Appeal, stated at §25 of his judgment that Hussain Tasawar was righty decided and that the functus principle applied to the Board in relation to validly withdrawn claims.

41.  Two points may be made arising out of the decisions in Hussain Tasawar and Ali Usman.  First, if the functus principle applies to a validly withdrawn claim, it must apply, a fortiori, to a claim which has been determined by the Board on the merits.  Second, neither the learned Deputy Judge nor the Court of Appeal drew any distinction between an appeal to the Torture Claims Appeal Board under Section 37ZR of the Ordinance and a petition to the Non-refoulement Claims Petition Office under the USM.

42.  In the present case, the 1^st Respondent heard the 1^st to 3^rd Applicants’ appeals in respect of their non-refoulement claims based on torture risk, persecution risk and/or BOR 3 risk, and dismissed their appeals by the Issued Decisions given on 30 September 2015, 15 December 2016 and 23 December 2016 respectively.  Once the Issued Decisions were given, the Board became functus so far as the relevant appeals were concerned, and had no power to re-open them.  It follows that the 2^nd Respondent had no power or jurisdiction to direct that the Issued Decisions be superseded, or the relevant appeals be heard de novo by another Board Member/Adjudicator.

43.  I would add, in passing, that I can see no good reason why the Issued Decisions should be set aside merely because the decision-maker (ie the 1^st Respondent) lost his laptop computer which contained some personal data of the 1^st, 2^nd and 3^rd Applicants and/or information concerning their non-refoulement claims some 21 to 36 months after giving the Issued Decisions.  The Issued Decisions are valid, and the 1^st to 3^rd Applicants’ non-refoulement claims based on torture risk, persecution risk and/or BOR 3 risk should be regarded as having been finally determined.

(iv)    Ground 4: the Respondents’ failure to implement any policy and procedure to secure the safe transfer of personal data of non-refoulement claimants, and/or their failure to comply and/or ensure compliance with such policy and procedure, are Wednesbury unreasonable

44.  This ground concerned the 5^th Decision, and can be disposed of shortly.  The Applicants have not identified any particular source of duty on the part of the Respondents to implement any policy or procedure to secure the safe transfer of personal data of non-refoulement claimants pursuing appeals before the Board, save to state that in view of the confidential nature of the data collected in the course of non-refoulement claims, the need for a detailed protocol for safe transfer and protection of the personal data is self-evident[4].  It may be that an obligation of confidentiality should be implied in the circumstances, but a breach of such obligation cannot, in my view, be translated into a reviewable decision on the part of the Board not to implement any policy or procedure for the safe transfer of personal data of non-refoulement claimants, or not to comply or ensure compliance with such policy and procedure.  Although not mentioned in the Form 86, since the Board is a “data user”, it is under a statutory duty to comply with the data protection principles under Section 4 of the Personal Data (Privacy) Ordinance, Cap 486, in particular Principle 4 in Schedule 1 thereto, as follows:

“Principle 4 - security of personal data

(1) All practicable steps shall be taken to ensure that any personal data (including data in a form in which access to or processing of the data is not practicable) held by a data user is protected against unauthorized or accidental access, processing, erasure, loss or use having particular regard to -

(a) the kind of data and the harm that could result if any of those things should occur;

(b) the physical location where the data is stored;

(c) any security measures incorporated (whether by automated means or otherwise) into any equipment in which the data is stored;

(d) any measures taken for ensuring the integrity, prudence and competence of persons having access to the data; and

(e) any measures taken for ensuring the secure transmission of the data.

(2)     Without limiting subsection (1), if a data user engages a data processor, whether within or outside Hong Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other means to prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to the data processor for processing.”

45.  However, any complaint of a breach of the data protection principles by the Board ought to be pursued under the mechanism provided for in the Personal Data (Privacy) Ordinance, in particular (i) a complaint to the Privacy Commissioner under Section 37, who has statutory powers to investigate such complaint and, following the completion of an investigation, issue an enforcement notice if the Commissioner is of the opinion that the relevant data user is contravening or has contravened a requirement under the Ordinance, and (ii) an appeal to the Administrative Appeals Board against a decision of the Privacy Commissioner not to serve an enforcement notice on the relevant data user in consequence of the investigation concerned.

46.  Judicial review is generally a remedy of last resort, and an applicant is normally required to exhaust alternative remedies before making an application for judicial review.  There is no good reason in the present case why the Applicants should be permitted to challenge the 5^th Decision before pursuing the statutory remedies in relation to their complaint that the Respondents have failed to implement any policy and procedure to secure the safe storage and transfer of personal data of non-refoulement claimants pursing appeals before the Board, or ensure compliance with such policy and procedure.

DISPOSITION

47.  The application for leave to apply for judicial review under Ground 3 is granted, and the application for judicial review is allowed in respect of the 2^nd Decision.  An order of certiorari is granted to bring up to the High Court and quash the 2^nd Decision.  Save as aforesaid, the rest of the application for leave to apply for judicial review is dismissed.

48.  On the issue of costs, the Applicants have succeeded on only one of four grounds of judicial review, which relates to the 2^nd Decision.  It is, however, far from clear that the Applicants are any better off as a result of the quashing of the 2^nd Decision. Overall, I consider the fair order to make would be no order as to the costs of this application, save that the Applicants’ own costs are to be taxed in accordance with legal aid regulations.  I so order.

49.  Finally, the court should record that the Respondents and the Director have indicated that they would adopt a neutral stance, and have not filed any evidence or taken any part, in these proceedings. The court has therefore appointed Ms Sara Tong as Amicus Curiae in this case, and is grateful to Ms Tong for her clear and cogent submissions which have been of great assistance to the court in resolving the issues raised by the Applicants in this application.  The court is also grateful to Mr Nicholas Cooney, SC, together with Ms Nisha Mohamed and Ms Denise Souza, for their succinct and measured submissions on behalf of the Applicants to the court.