YIU WING CHING JOHN v. ONC LAWYERS (A FIRM) AND OTHERS

HCA 2823/2015

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

ACTION NO 2823 OF 2015

____________

____________

______________________

D E C I S I O N

______________________

1.  This is the Plaintiff’s appeal against the decision of the Master to strike out his Statement of Claim filed in these proceedings, on the Defendants’ application that the Statement of Claim is scandalous, frivolous or vexatious, may prejudice, embarrass or delay the fair trial, and is otherwise an abuse of the process of the Court.

2.  The Plaintiff’s claim against the Defendants in these proceedings is that they were in breach of their duties of confidentiality, and their fiduciary duties owed to the Plaintiff as a partner of the 1^st Defendant, a firm of solicitors, when the Defendants disclosed to a commercial lender (“Orix”) the confidential and private information contained in the Plaintiff’s Hong Kong identity card (“Confidential Information”).  In the action, the Plaintiff claims injunctive and other relief against the Defendants, including an inquiry as to the damages sustained by the Plaintiff as a result of the Defendants’ breach of duties and their conspiracy to injure the Plaintiff by unlawful means.

3.  The underlying facts are not in dispute.  The 1^st Defendant (“ONC”) is a firm of solicitors.  The 2^nd to 4^th Defendants were at the material time the equity partners of ONC.  In February 2012, the Plaintiff met with the 2^nd and 3^rd Defendants to discuss the possibility of his joining ONC as a salaried partner.  An employment agreement was signed on 13 February 2012, whereby the Plaintiff became a salaried partner of ONC with effect from 22 March 2012.  The Plaintiff tendered his resignation on 15 November 2012, and it does not appear to be disputed that he ceased to be a partner of ONC on 31 December 2012.

4.  It is common ground that in around February or March 2012, the Defendants obtained a copy of the Plaintiff’s identity card from him.  On 28 September 2012, 30 November 2012 and 14 December 2012 respectively, ONC applied for and obtained 3 loans from Orix in the total sum of approximately HK$4 million (“Loans”) and, in the process, ONC supplied to Orix at Orix’s request a copy of the Plaintiff’s identity card (“ID Copy”).

5.  The Plaintiff claims that the Defendants’ release to Orix of the ID Copy and of the Confidential Information was without his prior knowledge or consent, and that he only discovered in March 2013 that the Confidential Information had been released by the Defendants for the purpose of the Loans, the November Loan and the December Loan having been applied for and made after the Plaintiff had tendered his resignation to ONC.

6.  The Plaintiff made a complaint to the Police and to the Office of the Privacy Commissioner for Personal Data (“PCPD”) in March 2013, alleging that the Defendants were in breach of s 64 of the Personal Data Privacy Ordinance (“Ordinance”).  The Plaintiff claimed that his personal data had been released by ONC to Orix for the purpose of the unauthorized Loans, all without his consent, and that he was recorded as being a borrower of the Loans in the credit report maintained by TransUnion Limited (“TU”). 

7.  By letter dated 27 March 2013, ONC requested Orix to remove the name of the Plaintiff (as a salaried partner of ONC) from TU’s database.  On 3 April 2013, Orix confirmed that such information had been removed. 

8.  On 27 May 2014, PCPD informed the Plaintiff by letter that it would not continue further investigation of the Plaintiff’s complaint against the Defendants (“PCPD Decision”).  The reasons stated for such decision were that, firstly, the PCPD accepted ONC’s explanation that the ID Copy was used by Orix for verification of the Plaintiff’s identity as a partner of ONC, and the PCPD accepted that any person dealing with ONC was entitled to know the identity of each of its partners.  The PCPD saw no reason to speculate whether the Plaintiff’s ID Copy might have been misused by the Defendants in contravention of the Ordinance.  In the PCPD Decision, reference was made to Data Protection Principle 3 (“DPP 3”), in the PCPD’s consideration of whether there was breach of the requirements of the Ordinance. 

9.  The PCPD further stated in the PCPD Decision that since the Plaintiff was no longer a partner of ONC, and the Defendants had no further need to provide the Plaintiff’s ID Copy to Orix, or to any other financial institution, for verification of the Plaintiff’s identity in the future, the PCPD considered that further investigation of the case could not reasonably be expected to bring about a more satisfactory result (“Practicality Ground”).  The PCPD therefore exercised its discretion under s 39 (2) (d) not to continue further investigation.

10.  The Plaintiff appealed against the PCPD Decision, which appeal was considered and rejected by the Administrative Appeals Board (“Board”).  By its decision dated 25 March 2015 (“Board Decision”), the Board agreed with the finding of the PCPD that there was no prima facie case of contravention of the Ordinance, and that the PCPD was entitled to exercise its discretion not to continue further investigation.

11.  The Plaintiff did not appeal against the Board Decision, nor seek judicial review of the Board Decision.  He commenced these proceedings on 2 December 2015, claiming the Defendants’ breach of confidence, breach of fiduciary duties, and conspiracy.  Pleadings were filed and on 27 July 2016, the Defendants applied to strike out the Statement of Claim.  They argue that by reason of the PCPD Decision and the Board Decision and the findings made therein, the Plaintiff is estopped from pursuing his claims against the Defendants in these proceedings, since the issue has already been finally decided by the PCPD, and then by the Board, that it was legitimate for ONC to supply the Plaintiff’s ID Copy to Orix for the purpose of the processing of the Loans.

12.  The Master struck out the Statement of Claim by his order of 20 February 2017, and on appeal, the Plaintiff argued that no issue estoppel can apply in this case, in the absence of a final or binding determination by a competent court, in any proceedings or lis between the Plaintiff and the Defendants, on any of the issues in the action.

Applicable legal principles

13.  The principles for striking out are trite, and not in dispute.  It is only in plain and obvious cases that the power to summarily strike out should be exercised.  The claim must be obviously unsustainable, the pleadings unarguably bad and it must be impossible, not just improbable, for the claim to succeed before the court will strike it out.  Disputed facts are to be taken in favor of the party sought to be struck out, and if the court does not think the matter to be clear beyond doubt, or if it fails to be satisfied that there is no reasonable cause of action or that the proceedings are frivolous or vexatious, then there should be no striking out (para 18/19/4 Hong Kong Civil Procedure).

14.  As for issue estoppel which is the focus of the parties’ submissions, again, the principles are clear.  There must be the “issue requirement”, “finality requirement” and “privity requirement”, as summarized by Barma JA in Kan Wai Chung v Hau Wun Fai, CACV 43 of 2012, 7 February 2013.  For issue estoppel to apply, “there needs to be (a) a final or conclusive judgment, decision and/or finding on merits by an earlier court of competent jurisdiction, (b) the parties need to be the same, and (c) the issue in the later action, in which the estoppel is raised as a bar, must be the same issue as was decided by the judgment in the earlier action” (Tang Chung Wah & Anor v Jonathan Russell Leong and Ors HCA 1691/2011, 15 October 2013).

Whether issue estoppel applies

15.  In my view, it is plain that the issue decided by the PCPD and the Board is not the same as the issue to be decided in these proceedings.  It is in any event not plain and obvious that the Plaintiff’s claims of breach of fiduciary duties as made in this case are so unarguably bad and obviously unsustainable, that the action should be summarily struck out.

16.  Leaving aside the Practicality Ground, the PCPD Decision not to continue further investigation was based on the PCPD’s conclusion that the Plaintiff’s ID Copy was used by Orix for verification of the Plaintiff’s identity as a partner of ONC, and that there was no reason to speculate that the Plaintiff’s ID copy might have been misused in contravention of the Ordinance. 

17.  In affirming the PCPD Decision not to continue further investigations, the Board agreed with the PCPD that there was no prima facie case of contravention of any requirement of the Ordinance.  The principle considered by the PCPD to be relevant, and as affirmed by the Board, is DPP 3.

18.  Under the Ordinance, DPP 3 provides as follows:

“(1) Personal data shall not, without the prescribed consent of the data subject, be used for a new purpose.

…

(4) In this section –

new purpose, in relation to the use of personal data, means any purpose other than –

(a) the purpose for which the data was to be used at the time of the collection of the data; or

(b) a purpose directly related to the purpose referred to in paragraph (a).”

19.  At paragraph 8 of the Board Decision, the Board states:

“The Appellant contends that the purpose of supplying his personal data to Orix is without his consent or not for a purpose directly related to the original purpose of their collection. He suggested that the purpose was to obtain a loan or on a favorable term. This Board finds that the purpose of supplying the personal data in question is not for the purpose of obtaining a loan. … Out of the need to verify the identity of each partner, Orix asked for and ONC supplied the personal data of the Appellant to the former. … There might be a dispute as to whether he was explicitly told that his personal data would be released to banks or other parties for a legitimate purpose for verifying the identity of the partners of the firm. On the assumption that he did not give such explicit consent or prescribed consent when ONC collected his personal data when appointing him as a salaried partner, the purpose for collecting such personal data of his must include the purpose for supplying them for any legitimate purpose of verifying the identity of the partners of the firm. As it has been pointed out the purpose for verifying the identity in the circumstances of the case is lawful and legitimate. Such purpose must therefore be a purpose directly related to the original purpose of collecting the same. To find otherwise is upfront to common sense. … In the premises this Board agrees with the finding of the (PCPD) that there was no prima facie case of contravention of a requirement of the Ordinance.”

20.  The decision of the PCPD and of the Board is that the Plaintiff’s ID Copy was supplied by the Plaintiff and collected by ONC for the purpose of verifying the identity of the partners of ONC.  The PCPD and the Board accepted ONC’s case, and found that Orix was legally obliged to verify the identity of its clients and that ONC had supplied the Plaintiff’s ID Copy and Confidential Information to Orix out of the need to verify the identity of each partner of ONC, including the Plaintiff.  The Board found that the purpose of verifying the identity of the Plaintiff as a partner of ONC is a purpose which is directly related to the original purpose of ONC collecting the personal data of the Plaintiff, and hence, that there was no breach of DPP 3.

21.  The pertinent findings of fact and law made by PCPD and the Board are that:

(1) Orix is obliged to verify the identity of ONC (including the Plaintiff as a partner) (para 6 of the Board Decision);

(2) the purpose of ONC in supplying the Plaintiff’s personal data to Orix is not for the purpose of obtaining a loan (para 8, page 7 of the Board Decision);

(3) the purpose of ONC collecting the Plaintiff’s personal data includes the purpose of supplying the Plaintiff’s personal data for any legitimate purpose of verifying the identity of the partners of ONC (“Original Purpose”), which purpose is lawful and legitimate (para 8, page 7- 8 of the Board Decision);

(4) the purpose of ONC supplying and Orix receiving the Plaintiff’s ID Copy for verifying the identity of the partners of ONC is a purpose directly related to ONC’s Original Purpose of collecting the Plaintiff’s personal data (para 8, page 8 of the Board Decision);

(5) there was no prima facie case of contravention of a requirement of the Ordinance (para 8, page 8 of the Board Decision); and

(6) the Board was entitled to exercise its power not to continue further investigations into the Plaintiff’s complaint of a breach of the Ordinance.

22.  Significantly, there was no finding made, in either the PCPD Decision or the Board Decision, that the Plaintiff was told that his personal data would be released to banks or other parties to verify his identity as a partner of ONC, or that the Plaintiff had given any consent to such effect, when ONC first collected his ID Copy.  The Board’s finding, that the purpose of ONC collecting the Plaintiff’s personal data “must include the purpose for supplying them for any legitimate purpose of verifying the identity of the partners of (ONC)”, was made on the expressed “assumption” that the Plaintiff did not give his consent to the release of his personal data to other parties for the purpose of verifying the identity of the partners.  The Board noted that there was a dispute as to this.

23.  On behalf of the Defendants, Leading Counsel argued that the findings made by the PCPD and the Board as to the legitimacy of the Defendants’ supply of the ID Copy to Orix, for the same purpose as the Original Purpose, or a purpose directly related thereto, is fatal to the Plaintiff’s causes of action for breach of confidence, and breach of fiduciary duty.  Mr Shieh pointed out that since the supply of the ID Copy to Orix has been found to be legitimate, and for the same Original Purpose, or as being directly related to the Original Purpose, the Plaintiff cannot show that he had any “reasonable expectation of privacy” in relation to his ID Copy or the Confidential Information, which is essential to establish a cause of action based on breach of confidence (Clerk & Lindsell on Torts, 21^st edition, paras 27-02 to 27-03, 27-37; Sim Kon Fah v JBPB & Co [2011] 4 HKLRD 45, paras 44, 61, 67).

24.  I cannot agree with the Defendants, that the issue which had been decided by the PCPD and the Board was as broad as to “whether it was legitimate” for ONC to supply the ID Copy to Orix.  Read in the proper context, the reference made by the Board to the “legitimate purpose” of verifying the identity of the partners of ONC can only be a reference to such purpose being legitimate and lawful under the Ordinance, as a purpose directly related to the purpose for which the data was to be used at the time of the collection of the data, within the meaning of DPP 3.

25.  The complaint made by the Plaintiff to the PCPD and the Board is in respect of breach of the requirements of the Ordinance, in short, whether there is a breach of the data privacy principles under the Ordinance.  The PCPD Decision and the Board Decision found, on the facts, that there was no breach of DPP 3 as the Plaintiff’s personal data had not been used by ONC for a “new purpose”.  The only relevant finding is that ONC’s supply to Orix of the Plaintiff’s ID Copy was for the purpose of verifying his identity as a partner of ONC, and irrespective of when this was done, this did not constitute a “new purpose” under the Ordinance.

26.  Whether there can be a reasonable expectation of privacy is, obviously, an objective question of fact, dependent on the circumstances of each case.  In the present case, it is not obviously unsustainable for the Plaintiff to argue that in respect of ONC’s application to Orix for a loan on 30 November and 14 December 2012, at a time when the Plaintiff had submitted his resignation as a partner, the Plaintiff had the reasonable expectation that the Confidential Information should be kept confidential, and should not be disclosed or released to Orix, without his knowledge and prior consent, for the purpose of obtaining a loan which extends to a period of time when he is no longer a partner of ONC.  It is reasonably arguable that the Plaintiff had such a reasonable expectation at the time when he first provided the ID copy to ONC, and at the time when ONC applied for the November Loan and the December Loan.  If there is arguably a reasonable expectation of privacy, the Plaintiff’s cause of action in breach of confidence by the Defendants is not doomed to fail or unarguably bad.

27.  The law imposes on a partner the most fundamental obligation to display complete good faith towards his co-partners in all partnership dealings and transactions (Lindley & Banks on Partnership, 18^th edition, para 16-01).  As Vice-Chancellor Bacon put it in Helmore v Smith (1886) 35 Ch D 436, 444, there is no stronger case of fiduciary relationship than that which exists between partners:

“Their mutual confidence is the lifeblood of the concern. It is because they trust one another that they are partners in the first instance; it is because they continue to trust each other that the business goes on.”

Utmost good faith and “the first duties” of honesty have been rigorously upheld by the courts and imposed on partners (Carmichael v Evans [1904] 1 Ch 486, 492) in their dealings with each other and with third parties.

28.  In my judgment, there is no finding made by PCPD or the Board which precludes a cause of action based on the Defendants’ breach of their fiduciary duties of good faith and honesty, owed by them to the Plaintiff as partners, which requires the Defendants from notifying the Plaintiff of their application for the November Loan and the December Loan, and seeking his consent to the release of his ID Copy for the purpose of these loans made to ONC, at a time when the Plaintiff had already submitted his notice of resignation as a partner of ONC. 

29.  Applying the principles for striking out, I do not consider that the Plaintiff’s claims of breach of fiduciary duties and duties of confidence as made against the Defendants are obviously unsustainable, or that it is impossible for these claims to succeed.  Disputed facts, as to whether the Plaintiff was informed when his ID Copy was supplied to ONC that it would be released to third parties to verify the identity of the partners of ONC, and as to whether the Plaintiff knew of the application for the Loans, should all be taken in favor of the Plaintiff. 

30.  Having found that there is no common issue which was decided by the PCPD and the Board, there is no necessity to decide on the finality and privity requirements.

31.  It follows from my conclusion on the limited scope of the issues found by the PCPD and the Board that I do not consider the Plaintiff’s claims made in these proceedings to be a collateral attack on the PCPD Decision or the Board Decision.

Whether claims are frivolous, embarrassing or an abuse of process

32.  For the same reasons elaborated upon in the preceding paragraphs under the finding of issue estoppel, I find that the Plaintiff’s claims for breach of confidence and breach of fiduciary duties are not frivolous, vexatious or an abuse of process.  The claims cannot be said to be incapable of reasoned argument, or without foundation. 

33.  The pleading as to the representations made by the 2^nd and 3^rd Defendants at the time of their meeting with the Plaintiff in January or February 2012 relate to the background and factual matrix for the supply of the Plaintiff’s ID Copy and Confidential Information to ONC.  There is no basis for striking out the entire Statement of Claim, as sought in the Summons of 27 July 2016, on the basis of the paragraphs complained of by the Defendants. 

Conclusion

34.  I allow the Plaintiff’s appeal against the Master’s order of 20 February 2017, and dismiss the application for striking out the Statement of Claim.  I make an order nisi that the Defendant should pay the costs of the appeal and those below, with certificate for Counsel.