EASTWEEK PUBLISHER LTD. AND ANOTHER v. PRIVACY COMMISSIONER FOR PERSONAL DATA

CACV 331/1999

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF APPEAL

CIVIL APPEAL NO. 331 OF 1999

(ON APPEAL FROM HCAL 98/1998)

____________________

_________________

J U D G M E N T

_________________

Ribeiro JA (giving the first judgment at the invitation of Godfrey VP):

1. Eastweek magazine was described in submissions as a glossy variety magazine with a wide circulation in Hong Kong. It is published by Eastweek Publisher Limited which is owned by Eastweek Limited. As earlier points turning on the identity of the publisher no longer arise, I will refer to the publisher as "Eastweek" and the magazine simply as "the magazine".

2. In early September 1997, one of Eastweek's reporters decided to write an article, illustrated by photographs, on the fashion sense of women seen on Hong Kong streets. Accordingly, one of its photographers, on the reporter's instructions, took pictures of various women seen in public and, on 25 September 1997, the article, accompanied by some of those pictures, was published.

The Complaint

3. On 29 September 1997, the Privacy Commissioner for Personal Data ("the Commissioner"), received a complaint from Maria Tam Nga Wai ("the complainant") which, in translation, stated as follows :-

"Without my consent, [the publisher of Eastweek magazine] published my photograph on 25 September in one of its supplements. It also made some adverse comments about me which caused me a lot of trouble when I made contacts with my business clients. That photo was secretly taken of me by [that Magazine Publisher] without my consent."

The article complained of includes photographs of six different young women. None of them are identified by their full names. They are referred to by first names (in some cases in quotation marks, suggesting that they may have been invented by the reporter) or by some descriptive phrase. For instance, one woman is referred to as "Tall Miu", another as "Junnie" and a third as "Chibi Maru Ko Virginia" - the first three words apparently being a reference to a Japanese cartoon character. One of the other women photographed is referred to as "the 'red flower' lady" because of the garment she was shown wearing and her companion called simply "red flower lady's friend". The complainant was referred to as "Japanese Mushroom Head", apparently because of what the reporter called "her mushroom hairstyle".

4. The article tends to be flattering or complimentary regarding the fashion sense displayed by most of the women photographed. However, one can readily see why the complainant is likely to have found the comments made about her unflattering and unwelcome. In translation, the commentary ran as follows :-

"Japanese Mushroom Head. One can easily tell that this lady has a very sharp sense of what fashion is about. You only need to look at her mushroom hairstyle and irregular-edged skirt! However, her accessories including the black overcoat and black leather shoes look very incompatible to her style. The biggest failure is her handbag. So awkward ....... that 'little reporter' thought that she had mistakenly taken her mom's handbag. Although there is no fixed and fast rules for fashion, a perfect 'Mix and Mismatch' requires in-depth knowledge and skill and is not as easy as it may look. Let all ladies be aware of this."

The Commissioner's decision

5. After a hearing, the Commissioner made the following findings (set out in his letter dated 5 October 1998 to Eastweek's solicitors), namely, that :-

(i) Eastweek's photographer, acting on the reporter's instructions and as agent for the publisher, had taken the published photograph of the complainant in a public street in Causeway Bay, using a long-range lens, without her knowledge or consent.

(ii) After taking the picture, the photographer had made an effort to reach the complainant with the intention of seeking her consent to the publication but, because of the crowded conditions, he had failed to reach her before she disappeared from view.

(iii) After the picture appeared in the magazine, the complainant's colleagues and others made fun of her and made her too embarrassed to wear the same clothing (which was new) again.

On the basis of such findings, the Commissioner found that there had been a breach of the first data protection principle ("DPP1") given force by the Personal Data (Privacy) Ordinance (Cap 486) ("the Ordinance"). In particular, he found a contravention of the paragraph ("DPP1(2)") which requires personal data to be collected only by means which are "fair in the circumstances of the case". He decided that in the present case, Eastweek had collected personal data concerning the complainant using unfair means, for the following reasons :-

(i) While the fact that a photograph is taken as part of "news activity" is relevant to assessing the fairness of the means of collection, the contents of the article showed that Eastweek was not engaging in news activity, so that this factor did not enter into the assessment.

(ii) While it was not unfair to have failed to seek her prior consent because of the photographer's desire to capture her in a natural pose, it was unfair to have taken her picture without her knowledge, using a long lens.

(iii) Taking a photograph without the subject's prior knowledge or consent, was unfair unless other circumstances negatived the unfairness, for example, the existence of "a policy on the taking of adequate measures to ensure that the privacy rights of the individual are subsequently protected", for instance, by not publishing pictures in which that person is identifiable or "only publishing them in such a way that the subject is not identifiable." Eastweek did not have such a policy.

(iv) Although the photographer did attempt to obtain the complainant's consent after taking the picture, this did not negative the unfairness of the means of collection because, in the crowded conditions, he did not have any reasonable ground to believe that he or the reporter would succeed in reaching the complainant to ask for her consent. There was also no basis for assuming that consent would be forthcoming.

In his letter of 5 October 1998, the Commissioner indicated that he might serve an enforcement notice on Eastweek under section 50 of the Ordinance unless undertakings negativing the likelihood of similar contraventions in the future were given. He also stated that a report might be published under section 48.

6. The undertakings sought were set out by the Commissioner in draft and involved a promise by Eastweek that it would not in future, "without the knowledge or consent of any living individual in Hong Kong take the photograph of such individual in a public place from which it is reasonably practicable for him/her to be identified," unless certain exceptions applied. These were exceptions allowing photographs used in the reporting of matters "considered to be of importance to the public", photographs of public figures or persons who, by conduct, invite being photographed, pictures of persons who are incidentally caught within the frame and exceptions where a policy is operated to ensure that persons who are photographed without their consent are not identifiable in the published picture.

Judicial review

7. On 19 October 1998, Eastweek applied for leave to seek judicial review of this decision. It sought an order of certiorari quashing the Commissioner's decision on the grounds that it was erroneous in law or unreasonable on Wednesbury principles and had been arrived at in breach of procedural fairness. Leave was granted on 22 October 1998 and the matter came on for hearing before Keith JA (sitting as an additional judge of the Court of First Instance) on 15 March 1999 and, after certain amendments and an adjournment to allow certain legal points to be addressed, again on 17 September 1999. Judgment was handed down on 24 September 1999.

8. Keith JA dismissed the application. He held that the issue before the Commissioner was whether the means by which the photograph had been taken were fair in the circumstances of the case. The attacks by Eastweek on the Commissioner's decision that such means had been unfair were rejected for the following reasons :-

(1) Given the contents of the article, he had been entitled to hold that Eastweek was not involved in "news activity". Accordingly, he had not erred in failing to take "news activity" into account when assessing fairness.

(2) While at first blush the Commissioner's decision might be thought vulnerable because he had accepted that the complainant's prior consent was not needed but had treated her lack of knowledge as an instance of unfairness, his decision, properly understood, had in fact been that :-

"What rendered the taking of the photograph unfair was the fact that it was taken without the complainant's knowledge or consent at a time when (a) the photographer did not have reasonable grounds for thinking that he would be able to obtain her consent to its publication, and (b) the magazine did not have a policy of publishing someone's photograph (obtained without the person's knowledge or consent) in such a way that the person cannot be identified."

(3) It was open to the Commissioner to uphold the complaint on those grounds.

(4) There had also been no procedural unfairness in reaching his decision.

Having dealt with the questions bearing on the fairness of the means of collection, Keith JA turned to deal with what, analytically, is a prior question, namely, "whether the photograph which had been taken of the complainant could be regarded as 'data' ", commenting that :-

"This issue raised important questions as to the scope of the Ordinance and the Commissioner's powers, and where the line between the protection of personal data and the protection of privacy is to be drawn."

The Commissioner argued that the photograph was properly regarded as personal data while counsel for Eastweek (then Mr Jason Pow) adopted "a neutral stance" on the issue and made no submissions either for or against that proposition. Keith JA appears to have considered that question unresolved but decided to uphold the Commissioner's decision and to dismiss Eastweek's application for judicial review in the following terms :-

" ....... although I have real doubts as to whether the photograph of the complainant amounts to data about her, and although I therefore have real doubts as to whether the DPPs were even engaged, I have concluded that I should not give effect to these doubts."

This appeal

9. It is from the abovementioned judgment of Keith JA that Eastweek now appeals. Mr John Griffiths SC, appearing with Mr Jason Pow for Eastweek, now seeks to argue (reflecting Keith JA's doubts mentioned above) that it is indeed the case that the data protection principles have not been engaged and that the measures in the Ordinance aimed at the protection of personal data were never intended to apply to a factual situation like the present. Mr Gerard McCoy SC, appearing with Mr Ambrose Ho for the Commissioner, argued that the wording of the Ordinance is entirely apt to catch the taking of the photographs in this case as a contravention of DPP1(2).

10. I have come to the conclusion, for the reasons given below, that Mr Griffiths is correct and that on the true construction of the Ordinance and on the unchallenged findings of the Commissioner, DPP1(2) was not engaged or contravened.

The relevant provisions of the Ordinance

11. The Commissioner's finding, upheld by Keith JA, that there was a contravention in the present case must rest mainly on two provisions of the Ordinance. The first is section 4 which reads as follows :-

"A data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or practice, as the case may be, is required or permitted under this Ordinance."

The second is the relevant data protection principle, namely DPP1(2)(b), which provides as follows :-

"Personal data shall be collected by means which are ....... fair in the circumstances of the case."

Some of the terms used in or relevant to the abovementioned provisions have been defined in the Ordinance, including the following :-

- "Data": " means any representation of information ....... in any document ......."

- "Data subject" : "in relation to personal data, means the individual who is the subject of the data."

- "Data user" : "in relation to personal data, means a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data."

- "Personal data" : "means any data -

(a) relating directly or indirectly to a living individual;

(b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and

(c) in a form in which access to or processing of the data is practicable."

What constitutes a contravention

12. As appears from its wording, what section 4 prohibits is an "act" or a "practice", that contravenes a data protection principle (subject to what the Ordinance may permit or require). In all cases where DPP1 is said to be contravened, the contravening act must involve the act of collecting personal data, this being the subject-matter of DPP1. Where, as in the present case, it is alleged that DPP1(2)(b) is contravened, the contravening act becomes, in particular, the act of collecting personal data using unfair means.

13. It will be evident that a contravention requires two elements to be present: (i) an act of personal data collection; and (ii) doing this by means which are unfair in the circumstances of the case. In my view, the argument before the Commissioner and Keith JA focussed excessively on the second element, i.e., on "fairness"; and failed sufficiently to consider whether the facts of the present case amounted to an act of personal data collection in the first place.

14. In my judgment, they do not. It is, in my view, of the essence of the required act of personal data collection that the data user must thereby be compiling information about an identified person or about a person whom the data user intends or seeks to identify. The data collected must be an item of personal information attaching to the identified subject, as the abovementioned definitions of "personal data" and "data subject" suggest. This is missing in the present case. What is crucial here is the complainant's anonymity and the irrelevance of her identity so far as the photographer, the reporter and Eastweek were concerned. Indeed, they remained completely indifferent to and ignorant of her identity right up to and after publication of the offending issue of the magazine. She would have remained anonymous to Eastweek if she had not lodged a complaint and made her identity known. In my view, to take her photograph in such circumstances did not constitute an act of personal data collection relating to the complainant.

15. One may contrast what happens in a paradigm example of protected personal data collection. What comes to mind is the case of a person applying for a bank loan or the issue of a credit card or for cover from an insurance company. He is asked to fill in an application form, this being the relevant act of personal data collection. He is required to fill it in with items of personal information such as his age, present and previous occupation, income, any criminal convictions, any health problems, and so on. Plainly, in such cases, the data user is collecting such information about the specific individual in question and identifies him in its database or other records as the person to whom the information collected relates, i.e., as the data subject.

16. When, in the present case, the photographer took the photograph of the complainant, it was not in order to collect data relating to her as an identified individual. She was used as an anonymous photographic subject to illustrate a certain dress or fashion sense which the reporter saw fit to denigrate. Her identity was not known and was not needed for the article. This was also true of the other women photographed for the article. If no complaint had been made to the Commissioner and, say, a year later, someone had hypothetically asked Eastweek to provide any information that it had relating to Maria Tam Nga Wai (assuming that in the meantime she had had no further contact with Eastweek), it seems clear that Eastweek would have responded that it did not have any records relating to such an individual, even if the offending photograph and article remained available in its electronic and print archives. Those items would not have been collected in or intended to be retrievable from such archives as personal data relating to the complainant.

17. A data user's acceptance and upholding of the subject's anonymity may obviously exist in contexts other than the taking of photographs. In my view, in such cases, the gathering of information about the anonymous subject would again almost certainly not constitute the collection of personal data within the meaning of the Ordinance (although I would not wish altogether to exclude the existence of possible exceptions).

18. For example, someone conducting market research may interview a visitor leaving Hong Kong at Chek Lap Kok airport and elicit items of highly personal information such as his income group, why he visited Hong Kong, how much he had spent on shopping while here, how many times he had dined in restaurants on his visit, and so forth. Plainly, these would all be items of information which would constitute personal data if related to an identified person and the act of eliciting that information would, in such cases, amount to an act of personal data collection. However, because the market research survey does not know and is not concerned in the slightest with the identity of the respondent, being concerned merely to build up a statistical picture of the habits and preferences of classes of visitors to Hong Kong, I would not consider such an interviewer to be engaged in an act of personal data collection in relation to the interviewee.

19. Where, however, the interviewer does ascertain the interviewee's identity, he is likely to be caught by the section and would have to rely on the limited exemption given by section 62 of the Ordinance in the following terms :-

"Personal data are exempt from the provisions of data protection principle 3 where -

(a) the data are to be used for preparing statistics or carrying out research;

(b) the data are not to be used for any other purpose; and

(c) the resulting statistics or results of the research are not made available in a form which identifies the data subjects or any of them."

Inhibiting the press

20. The distinction discussed above is, to my mind, potentially important and must be preserved if legitimate journalistic activity and particularly photo-journalism is not to be unduly inhibited by the Ordinance.

21. Thus, a newspaper may wish to publish photographs illustrating a social phenomenon in which, inevitably, persons whose identities are not known to the publisher and not considered relevant by him, will be identifiably depicted. For example, a business editor may consider it newsworthy to publish a photograph of a crowd jostling in a queue for an initial public offering of shares in a company or for the purchase of flats in a new property development; a features editor may likewise want a photograph of teenagers smoking cigarettes to illustrate a feature article on health concerns and a sports editor may want to print a picture of racegoers at Happy Valley to illustrate attendance in record numbers. In each of those cases, it is conceivable or even likely that some of the persons identifiable in the photographs may not welcome publication of their picture. Nevertheless, in none of those cases, is the publisher or editor in question seeking to collect personal data in relation to any of the persons shown in the photographs and, in my view, the taking of such pictures and their use in such articles would not engage the data protection principles (whatever other liability, if any, such publication may attract).

22. It should be stressed that the fact that the photograph, when published, is capable of conveying the identity of its subject to a reader who happens to be acquainted with that person, just as the complainant's teasing colleagues were able to identify her from the picture in the magazine, does not make the act of taking the photograph an act of data collection if the photographer and his principals were acting without knowing or being at all interested in ascertaining the identity of the person being photographed.

Support from other provisions of the Ordinance

23. In my view, many of the other provisions of the Ordinance and in the data protection principles can only operate sensibly on the premise that the data collected relates to a subject whose identity is known or sought to be known by the data user as an important item of information.

24. Thus, section 18 empowers :-

"an individual ....... to make a request (a) to be informed by a data user whether the data user holds personal data of which the individual is the data subject".

This plainly assumes that the personal data is compiled in relation to identified individuals so that a search against the requesting individual's name or other personal identifier (such as an account number) will yield an answer to the data access request. This assumption is made clear in section 20(1) which provides as follows :-

"A data user shall refuse to comply with a data access request -

(a) if the data user is not supplied with such information as the data user may reasonably require -

(i) in order to satisfy the data user as to the identity of the requestor ......."

The Ordinance therefore assumes that the identity of the requestor is to be matched against the identity of the data subject in the data user's database. If the requestor cannot satisfy the data user of his identity, the data user is precluded from complying. The same approach is evident in section 24(1)(a) dealing with requests for data correction.

25. To take another aspect of the Ordinance, section 30 prohibits personal data matching procedures unless certain conditions are satisfied. One such condition is that :-

" ....... each individual who is a data subject of the personal data the subject of that [intended matching] procedure has given his prescribed consent to the procedure being carried out."

This would obviously be unworkable unless the data user who wants to carry out a data matching procedure is able to identify the data subject in order to obtain his consent.

26. Again, by section 34, a data user who has obtained personal data from any source and uses it for direct marketing purposes is required when first using such data inter alia "to inform the data subject that the data user is required, without charge to the data subject, to cease to so use those data if the data subject so requests". Obviously, unless the data subject's identity was known, direct marketing could not be directed at him and the obligation to give him the prescribed information would make no sense.

27. Turning to the data protection principles, DPP3 provides as follows :-

"Personal data shall not, without the prescribed consent of the data subject, be used for any purpose other than -

(a) the purpose for which the data were to be used at the time of the collection of the data; or

(b) a purpose directly related to the purpose referred to in paragraph (a)."

The data user is therefore expected to be able to seek consent from the data subject some time after data relating to him was first collected so that knowledge of his identity is again assumed.

28. This assumption is made particularly clear by DPP6 which provides as follows :-

"A data subject shall be entitled to -

(a) ascertain whether a data user holds personal data of which he is the data subject;

(b) request access to personal data .......

(c) be given reasons if a request referred to in paragraph (b) is refused;

(d) object to a refusal referred to in paragraph (c);

(e) request the correction of personal data;

(f) be given reasons if a request referred to in paragraph (e) is refused; and

(g) object to a refusal referred to in paragraph (f)."

This entitlement can only make sense if the data user has compiled the data collected in relation to each identified data subject.

What this judgment is not deciding

29. Because of the novelty of the Ordinance and of the point arising for decision, it may be wise to state what is not being decided by this judgment.

30. In the first place, it is not being suggested that taking someone's photograph can never be an act of personal data collection. It plainly can, depending on the circumstances.

31. Thus, if someone's photograph is taken with a view to its inclusion as part of a dossier being compiled about him as an identified subject, the act of photography would clearly be an act of personal data collection. For example, the portfolio of photographs of particular actors, entertainers or fashion models maintained by a theatrical impresario or fashion modelling agency would clearly constitute personal data collected in relation to the individuals in question. Similarly, law enforcement agencies are likely to have databases including photographs of wanted persons whose identities may or may not be known. If unknown, their identities would be considered important and sought-after items of information. Such photographs clearly would constitute part of the personal data collected in relation to such wanted persons.

32. Mr Griffiths argued that a photograph cannot be data. With respect, I disagree. The definition of data as a "representation of information ....... in any document" is clearly apt of cover a photograph. A photograph may clearly constitute "a pictorial representation of information about a person's physical features and appearance in a document", it being common ground that photographs come within the concept of "document" as defined by the Ordinance.

33. Secondly, this judgment is not suggesting that the press or other media organizations fall outside the scope of the Ordinance. On the contrary, it is clear that they are caught by its provisions if and to the extent that they engage in the collection of personal data.

34. All sorts of reasons may exist for the media to collect personal data. For instance, one can envisage a newspaper engaged in investigative journalism compiling over a long period a dossier on a public official suspected of involvement in corrupt activity or of having financial interests which conflict with his public duties. To take a less dramatic example, a newspaper may build up files on well-known personalities for the purposes of writing their eventual obituaries. These are likely to be instances of personal data collection and, subject to the express exemptions provided by section 61 and DPP1(3), would fall within the scope of the Ordinance and the data protection principles. If photographs formed part of the dossiers compiled, they too would become personal data subject to the statutory requirements.

Personal data protection and not a general right to privacy

35. Mr Griffiths stressed the limited protection to privacy afforded by the Ordinance. As its long title states, it is "an Ordinance to protect the privacy of individuals in relation to personal data, and to provide for matters incidental thereto or connected therewith." It is therefore not intended to establish general privacy rights against all possible forms of intrusion into an individual's private sphere or, as an American judge succinctly put it in an early text-book, a general "right 'to be let alone' " (Judge Cooley in Cooley on Torts, 2d ed., p 29, cited in Warren & Brandeis, "The Right to Privacy" (1890) 4 Harv LR 193).

36. The distinction between other interests in privacy and the protection of personal data is well-recognized. Thus, the Law Reform Commission of Hong Kong, whose Report on Reform of the Law Relating to the Protection of Personal Data provided the basis for the Ordinance as enacted, cited (at §5) four privacy "interests" identified by the Australian Law Reform Commission as follows :-

"(a) the interest of the person in controlling the information held by others about him, or 'information privacy' (or 'informational self-determination') as it is referred to in Europe;

(b) the interest in controlling entry to the 'personal place' or 'territorial privacy';

(c) the interest in freedom from interference with one's person or 'personal privacy';

(d) the interest in freedom from surveillance and from interception of one's communications, or 'communications and surveillance privacy'."

The Law Reform Commission made it clear (at §6) that it was only concerned in its Report with "information privacy". Protection of that particular interest is plainly also the aim of the Ordinance.

37. The complainant's position can usefully be considered in the context of the various privacy interests so distinguished. She obviously deserves the court's sympathy. Minding her own business and exercising her right as a citizen to use the public street, without in any way inviting media or public attention, she unwittingly found herself, or perhaps more accurately, her choice of attire, the object of sarcasm and derision in a widely-circulated magazine. Freedom of the press is of course of fundamental importance in our society. However, the complainant might quite understandably question the existence of any journalistic value in the article published. Putting it charitably for Eastweek, it was an article which sought to provide a degree of malicious amusement to Eastweek's readers at the complainant's expense, without ever having invited her to participate in the joke.

38. In my view, she would be entirely justified in regarding the article and the photograph as an unfair and impertinent intrusion into her sphere of personal privacy. However, unfortunately for her, the Ordinance does not purport to protect "personal privacy" as opposed to "information privacy" as mentioned above. Whatever sympathy one may feel for the complainant, in my judgment, Eastweek's conduct did not in law constitute a contravention of section 4, DPP1(2) or any other provision of the Ordinance.

39. It is accordingly my view that the appeal must be allowed and that certiorari should issue to quash the decision of the Commissioner.

Wong JA (dissenting) :-

Background

40. It was about noon on a Saturday in early September, 1997. A young woman was walking in a crowded street in Causeway Bay. Unknown to her, she was photographed by a photographer on the instructions of a reporter in the employ of the appellant, using an ordinary camera with the aid of a long-range lens. Without her consent or prior knowledge, her photograph was published with a commentary in the 25 September 1997 issue of the Eastweek Magazine. The commentary was unflattering and critical of her fashion sense. In the same article, there were photographs and commentaries about fashion sense of other women. The commentaries about them were flattering or complimentary. The publication caused her embarrassment and made her the subject of teasing by her colleagues. She lodged a complaint to the Privacy Commissioner for Personal Data under the Personal Data (Privacy) Ordinance (Cap. 486). The Commissioner conducted a hearing and upheld her complaint. He found the appellant in breach of data protection principle (DPP) 1(2) which states: -

"Personal data shall be collected by means which are :-

(a) lawful; and

(b) fair in the circumstances of the case."

The appellant was dissatisfied and challenged the decision by way of judicial review.

Hearing of the application

41. The application by the appellant for a writ of certiorari to quash the decision of the Commissioner was heard on 15 March 1999 before Keith JA sitting as an additional judge of the Court of First Instance. During the hearing, Keith JA expressed some doubt as to whether the photograph taken from the complainant could be regarded as "data" and invited counsel for both sides to address him on this point on 17 September 1999. He handed down his judgment on 24 September 1999 dismissing the application. It would be convenient now to dispose of what happened on 17 September. Counsel for the Commissioner argued that the photograph amounted to data, the information which the photograph contained being the physical features of the complainant. Mr. Pow who appeared for the appellant below adopted a neutral stance. In his judgment, Keith JA said at p.17 R-T and p.18 A-B :-

"I confess that I remain extremely sceptical about the correctness of the Commissioner's view, but since neither party wished to argue that the photograph did not amount to data, and because I have not had the benefit of any argument in support of my provisional view, I do not think that I should consider the matter further. The consequence is that, although I have real doubts as to whether the DPPs were even engaged, I have concluded that I should not give effect to these doubts."

42. The issue before the judge, as it was before the Commissioner, was whether the means by which the photograph had been taken were fair in the circumstances of the case. The judge made reference to DPP 1(2) and s. 4 of the Ordinance. Section 4 provides :-

"A data user shall not do an act, or engage in a practice, that contravenes a data protection principle unless the act or practice, as the case may be, is required or permitted under this Ordinance."

It is accepted that DPP 1(2) applies to the media although they are exempt from compliance with DDP 3, DPP 6, s. 18(1)(b) and s. 38(i) under s. 61 of the Ordinance if the business of the data user consists of a news activity and the use of the data is solely for the purpose of that activity. The arguments advanced by Mr. Pow on behalf of the appellant before Keith JA were centred on the fact that the taking of the photograph was "news gathering" within the definition of s. 61(3) of the Ordinance. This argument was rejected by Keith JA. The judge also rejected other arguments put forward by counsel for the appellant. Keith JA therefore concluded that the decision reached by the Commissioner, on the facts before him, was not irrational or Wednesbury unreasonable. It did not call for intervention by the courts.

This appeal

43. The notice of appeal contains six grounds. The main focus is still on whether the taking of the photograph is news activity as defined in s. 61. The first three grounds all relate to this point. The fourth ground complains that the Commissioner was wrong to consider as important on the question of fairness that the appellant did not maintain a policy of ensuring that a photograph taken without the subject's knowledge would only be used in such a way that the identity of the subject would not be revealed. It was submitted on behalf of the appellant that the taking of the photograph by the photographer was news activity, news gathering or journalistic activity and the Commissioner should have taken this into account when he considered whether the collection was fair in the circumstances. On these issues, Keith JA had upheld the findings of the Commissioner and concluded that the findings were not irrational or Wednesbury unreasonable.

Grounds 5 and 6

44. Despite the neutral stance adopted by the appellant before Keith JA, the appellant now seeks to argue the very same point which is whether the photograph of a person is "personal data" within the meaning of the Ordinance. Keith JA remained "extremely sceptical" that it was even after hearing submission from counsel for the Commissioner. But he went on to rule in favour of the Commissioner in default of arguments advanced on behalf of the appellant. It was submitted that the judge was bound to rule on the issue as a matter of law notwithstanding that the appellant had made no submission. Mr. Griffiths SC submits that the photograph of a person is not "personal data" and the taking of the photograph did not amount to collection of personal data. The taking of a photograph, he says, merely creates a "document" within the meaning of the Ordinance. But a photograph contains no representation of information relating to the living individual and it is not reasonably practicable to ascertain the identity of a person by a photograph which contains no other information about that person.

45. It can be observed that the arguments advanced before this Court departed substantially from the arguments advanced before the Commissioner and Keith JA. Be that as it may, the issue whether a photograph is "personal data" is an important one and should have been decided by the judge. It is very plain that the judge thought it was important.

Is a photograph "personal data"

46. I start with the definitions in s. 2. "Data" means any representation of information (including an expression of opinion) in any document, and includes a personal identifier. "Personal data" means any data -

(a) relating directly or indirectly to a living individual;

(b) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and

(c) in any form in which access to or processing of the data is practicable.

Document is defined to include "a film, tape or other device in which visual images are embodied so as to be capable, with or without the aid of some other equipment, of being reproduced from the film, tape or other device." A photograph is therefore within the definition of "document" and this is not disputed by the appellant. A photograph can tell many things. It tells the race, sex, approximate age, weight and height of the person shown in the photograph. On the other hand, the written description of a man called David Lee, aged 30 and lives in Tsimshatsui may not tell very much about the person. There may be a number of people who live in Tsimshatsui with the same name and age. He may be a Chinese or he may be a European or even an African. He may be tall or short, slim or bulky. The person in the photograph can only be the person himself or herself and no one else. The photograph contains some of the most accurate information of the person. Hong Kong is a small place by size. A number of individuals are known to and can easily be identified by members of the public by virtue of their jobs, professions or businesses. Less known figures are more difficult to identify but it is not impossible with the help of the photograph of the person. There are probabilities that the person in the photograph may emerge from anonymity like the complainant did in the present case. His or her friends, relatives or colleagues may respond with enquiries to the magazine on seeing the photograph. In my view, the photograph is "personal data" as it depicts the complainant and satisfies the three requirements under the definition of "personal data".

Object of the legislation

47. In his submission, Mr. Griffiths argues that the primary object of the Ordinance is to regulate the collection and use of personal data, not to provide relief for invasion of privacy as such. It is true that this is not an all embracing piece of legislation to protect privacy but it does set out to protect the privacy of individuals in relation to personal data as the long title of the Ordinance suggests. To that limited extent, the Ordinance protects the privacy of individuals and a purposive construction must be adopted to give effect to the legislative intent that is consistent with s. 19 of the Interpretation and General Clauses Ordinance, Cap. 1 which provides :-

"An Ordinance shall be deemed to be remedial and shall receive such fair, large and liberal construction and interpretation as will best ensure the attainment of the object of the Ordinance according to its true intent, meaning and spirit."

Law of Defamation and Press Freedom

48. Mr. Griffiths submits that if the complainant is not happy with the comments in the article, she would not be left without a remedy. It is open to her to bring an action for defamation against the publisher. This is a perfectly true and correct statement in so far as her legal position is concerned. In reality, the situation is not so simple. The law of defamation is not only technical, complicated and time-consuming but it also has become so expensive that only very few people can afford to take legal actions against rich and powerful newspapers or magazines. As for the small men and women, the doors of the law are out of their reach. This, perhaps, explains why the legislature steps in to give limited protection to these individuals to alleviate their hardship in a small way.

49. Mr. Griffiths also expresses fear that the Ordinance imposes restraints on the freedom of press. In my view, this is not well-founded. There is no such a thing as unqualified freedom of the press or absolute right of the individual. This is not a case of the freedom of press versus the right of the individual both of which are bulwarks of a free society. It is a case of the co-existence of two great principles that needs to be carefully balanced. A free press is, after all, a responsible press. Freedom, in whatever form, will only thrive under law.

Conclusion

50. In my view, the photograph of the complainant constitutes her "personal data" and the taking of the photograph by the photographer amounts to an act of collection and, as found by the Commissioner and upheld by Keith JA, the means used to collect the personal data of the complainant are unfair in the circumstances of the case. I will conclude with a passage of the speech of Lord Hailsham of St. Marylebone L.C. in Chief Constable of the North Wales Police and Evans [1982] 1 W.L.R. 1155 at pp.1160 and 1161 : -

"But it is important to remember in every case that the purpose of the remedies is to ensure that the individual is given fair treatment by the authority to which he has been subjected and that it is no part of that purpose to substitute the opinion of the judiciary or of individual judges for that of the authority constituted by law to decide the matters in question. The function of the court is to see that the lawful authority is not abused by unfair treatment and not to attempt itself the task entrusted to that authority by the law. There are passages in the judgment of Lord Denning M.R. (and perhaps in the other judgments of the Court of Appeal) in the instant case and quoted by my noble and learned friend which might be read as giving the courts carte blanche to review the decision of the authority on the basis of what the courts themselves consider fair and reasonable on the merits. I am not sure whether the Master of the Rolls really intended his remarks to be construed in such a way as to permit the court to examine, as for instance in the present case, the reasoning of the subordinante authority with a view to substituting its own opinion. If so, I do not think this is a correct statement of principle. The purpose of judicial review is to ensure that the individual receives fair treatment, and not to ensure that the authority, after according fair treatment, reaches on a matter which it is authorised by law to decide for itself a conclusion which is correct in the eyes of the court."

51. I respectfully adopt these words and dismiss the appeal.

Godfrey VP:

52. I have had the advantage of reading in draft the judgments prepared by Ribeiro JA and Wong JA. I agree with Ribeiro JA that, for the reasons he gives, we should allow this appeal. But since Wong JA is of a different opinion, I will briefly set out my reasons for coming to my own conclusion.

53. The first issue in the case, as I see it, is whether what Eastweek did here amounted to an act of personal data collection. If it did not, that is an end of the whole matter.

54. The judgment of Wong JA exhibits (if I may say so) a powerful argument in favour of a conclusion that what Eastweek did here did amount to an act of personal data collection. The essence of his reasoning is that personal data may be collected by means of a photograph (a proposition with which Ribeiro JA agrees and with which I also agree); and that therefore the taking of the complainant's photograph here by a photographer acting on the instructions of Eastweek's reporter was an act of personal data collection. The argument has an attractive simplicity; but, with respect, I find myself unable to accept it. I do not think it does follow, from the proposition that personal data may be collected by the means of a photograph, that the taking of photographs of people by or on behalf of a news publisher necessarily amounts to an act of personal data collection.

55. I prefer the view, expressed by Ribeiro JA, that it is of the essence of an act of personal data collection that the data user must thereby be compiling information about a person already identified or about a person whom the data user intends or seeks to identify.

56. I know this is not expressly spelled out in the legislation but I am satisfied from the way in which that legislation is framed that that is its underlying purpose, and that it was never intended to apply to the sort of factual situation which we have here. I do not believe that a literal interpretation of its various provisions for the protection of personal data compel a different conclusion; rather, the contrary.

57. For these reasons, I am of the opinion that the case for the complainant fails at the first hurdle and so, as I have already said, I agree with Ribeiro JA that we should allow this appeal.

58. I would add, since the majority in this court is differing from the judge below, that I consider the judge's "real doubts" as to whether this was a "data protection" case at all were fully justified, and it is a pity that the point was not adequately argued before him, especially since it is, in my view, a point of (at least) some general or public importance.

59. But, the court having decided (by a majority) to allow the appeal, it will be allowed accordingly, and we will order, subject to the provisions of Order 42 rule 5B(6) of the Rules of the High Court, that Eastweek's costs here and below be taxed (if not agreed) and paid by the Commissioner to Eastweek.