A v. ADMINISTRATIVE APPEALS BOARD AND ANOTHER

HCAL 244/2016

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CONSTITUTIONAL AND ADMINISTRATIVE LAW LIST

NO 244 OF 2016

___________________

___________________

_______________

D E C I S I O N

_______________

Introduction

1.  This application was filed by the applicant on 30 December 2016 and seeks the Court’s leave to apply for judicial review of the decision of the Administrative Appeals Board (AAB) which was handed down on 7 October 2016 following hearings on 23 February and 5 May 2016.  The applicant, who was the appellant in the AAB’s decision in Administrative Appeal No. 17/2015, in the papers filed sought an anonymity order which was granted by Au J on 9 January 2017.  The applicant is accordingly referred to as “A”.  

2.  The appeal heard by the AAB concerned the applicant’s appeal against a decision of the Privacy Commissioner for Personal Data (Privacy Commissioner) dated 30 April 2015, exercising his power under section 39(2)(d) of the Personal Data (Privacy) Ordinance, Cap 486, (the Ordinance), not to pursue further an undated complaint lodged by the applicant which was received on 9 February 2015. 

3.  The right of appeal to the AAB is provided under section 39(4) of the Ordinance.  The provisions governing an appeal are contained in the Administrative Appeals Board Ordinance, Cap 442.[1]

4.  The AAB dismissed the applicant’s appeal.

The background facts

5.  The applicant is a British national who resides in Hong Kong.  She is a single mother with a young son.  In November 2010, the applicant was arrested for alleged credit card fraud and placed on police bail. 

6.  In March 2011, the applicant’s son, who was then aged two, was placed in institutional care pursuant to a care and protection order on suspicion of the applicant committing the offence of child abuse or neglect.  The applicant sought assistance from PathFinders Limited (PathFinders), an approved charitable institution, whose main role is to provide assistance and support to distress migrant women and their children born in Hong Kong.  PathFinders assigned a case officer to the applicant to give her assistance and support as required.  In June 2011, PathFinders ceased providing assistance to the applicant after the police lifted the imposition of bail in relation to the alleged credit card fraud, and a court ordered that the applicant’s son be returned to her care.

7.  In February 2013, the applicant was rearrested for the alleged credit card fraud.  Some time at the end of March 2013, the applicant again sought the assistance of PathFinders.  She was brought into contact through a mutual acquaintance with a director of PathFinders who was designated her principal case officer.  The previous case officer was designated her secondary case officer.  Other case officers were also involved in assisting the applicant with her case. 

8.  The principal case officer immediately arranged legal representation for the applicant.  At about this time in early April 2013, the applicant was evicted from her rented premises. The applicant together with her son stayed intermittently at the principal case officer’s home. 

9.  On 9 April 2013, another person was assigned by PathFinders as the case manager of the applicant’s case.  Then on 15 April 2013, the applicant signed a “Consent to Release or Obtain Personal Data”, authorising representatives of PathFinders to obtain or release her personal data as required in the provision of services to her and her child.

10.  Throughout this period the case officers of PathFinders assisted the applicant to find new premises and help her with her legal case.  They also assisted the applicant with her mental health problems that she appeared to be suffering at the time. 

11.  According to PathFinders, the client relationship with the applicant came to an end in July 2013 and her case was formally closed on 7 October 2013.  According to the applicant, however, the client relationship continued, in particular with the principal case officer, until April 2014. 

12.  The dealings and the relationship between the applicant and the principal case officer is at the heart of this matter.  The principal case officer continued to have communications with the applicant in relation to her personal matters.  It appears they developed a personal relationship.  This has to a large extent blurred the capacities in which the principal case officer was dealing with the applicant. 

13.  Soon after in March 2014, the applicant received the Prosecution Bundle in relation to her trial in the District Court.

14.  On 17 April 2014, the applicant signed a Deed of Appointment of Guardians, appointing her parents as guardians of her son.  It was stated in the Deed that the applicant was desirous of her son being placed in the care of her parents and taken to their home in the United Kingdom where he should live and attend school, until such time as the applicant was in a position to provide a secure and stable home and take care of her son herself. 

15.  The Deed was executed by the applicant and her parents at the offices of the solicitors who had prepared the Deed.  The principal case officer was also present when this was done.

16.  It appears at around May 2014, for some reason the relationship between the applicant and the principal case officer deteriorated and they stopped communicating with each other. 

17.  In June 2014, the applicant pleaded guilty to the criminal charges that had been brought against her in the District Court and she was sentenced to a term of imprisonment of 12 months suspended for a period of 24 months.

18.  In July 2014, the applicant took out an action against her parents in the High Court (Family Division) in London for custody of her son.  It was during these proceedings that the applicant became aware of an email dated 2 August 2014 from the principal case officer to the applicant’s parents where she disclosed to them the Prosecution Bundle, and a Summary of Events compiled by the principal case officer, in order to assist her parents defend the custody action. 

19.  As best as I can ascertain from the limited and selective papers that have been submitted in support of the application, it appears that the principal case officer supplied this information to the applicant’s parents on the basis of permission previously given to her in her personal capacity by the applicant to share police evidence and anything else with the applicant’s parents in order for them to have the full story.  This was set out in the principal case officer’s email of 2 August 2014.

20.  As a result of what the principal case officer had done, the applicant lodged a complaint about the disclosure with PathFinders in October 2014.  She later lodged a complaint against PathFinders for the disclosure with the Privacy Commissioner on 9 February 2015.  The Privacy Commissioner provided the applicant a copy of his Complaint Handling Policy and thereafter made enquiries into the matter.

21.  On 5 March 2015, the Privacy Commissioner, by virtue of section 37 of the Ordinance, acknowledged the complaint by the applicant against PathFinders for disclosing the Prosecution Bundle and the Summary of Events to the applicant’s parents.  It is important to note that the complaint was directed against PathFinders and not to the principal case officer, although in that regard the applicant was submitting that when the principal case officer disclosed the information she was either acting in her capacity as a representative of PathFinders, or disclosing information that she obtained when a representative of PathFinders.

22.  On 30 April 2015, the Privacy Commissioner exercised his power under section 39(2)(d) of the Ordinance not to pursue the complaint further.

Complaint procedures under the Ordinance

23.  It is appropriate at this juncture to briefly examine the relevant provisions of the Ordinance. 

24.  Part 7 of the Ordinance deals with Inspections, Complaints and Investigations.  By virtue of section 37, a person may make a complaint to the Commissioner about an act or practice which, amongst other things, may be in contravention of a requirement under the Ordinance. 

25.  The Privacy Commissioner is obliged, subject to section 39, to carry out an investigation in relation to the alleged contravention.  Section 39 sets out restrictions on investigations initiated by complaints which under subsection (2)(d) empowers the Privacy Commissioner to refuse to carry out an investigation or further investigation if he is of the opinion that, having regard to all the circumstances of the case, it is unnecessary.  The Ordinance does not further specifically define the exercise of this discretion by the Privacy Commissioner.  It would naturally follow that the discretion should be exercised lawfully by reference to the legislative and administrative framework in place to address the aim and purpose of the Ordinance to protect the privacy of individuals in relation to personal data. 

26.  To this end, the Privacy Commissioner has issued a policy for the handling of complaints.  Paragraph 8(e) of the policy provides that an investigation or further investigation may be considered unnecessary if after preliminary enquiry by the Privacy Commissioner there is no prima facie evidence of any contravention of the requirements under the Ordinance.

The Privacy Commissioner’s decision

27.  The Privacy Commissioner gave reasons for his decision refusing to investigate the applicant’s complaint. The reasons were summarised in the AAB decision. 

28.  The Privacy Commissioner explained that PathFinders was not a data user in relation to the disclosure of the Prosecution Bundle and the Summary of Events as this was done by the principal case officer in her personal capacity. 

29.  A data user in relation to personal data is defined under section 2 of the Ordinance as “a person who either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data.” 

30.  In holding that PathFinders was not liable, the Privacy Commissioner noted the following matters.  First, the applicant’s parents were not clients of PathFinders.  Secondly, PathFinders ceased to have any relationship with the applicant from July 2013, which was before the material was sent by the principal case officer in her email dated 2 August 2014.  Thirdly, PathFinders did not collect or possess the Prosecution Bundle at any stage.  Fourthly, the Summary of Events was prepared by the principal case officer to assist the applicant’s parents in defending the custody action.  Fifthly, the principal case officer stated in her email of 2 August 2014 that the Prosecution Bundle and the Summary of Events were provided to the applicant’s parents in her personal capacity and not in her capacity at PathFinders. Sixthly, the email was sent out through the principal case officer’s personal email account.  Seventhly, the applicant acknowledged in her letter to the Privacy Commissioner dated 3 March 2015 that the principal case officer assisted the applicant’s parents in her personal capacity.

31.  It was for the foregoing reasons that the Privacy Commissioner held that PathFinders was not liable to the applicant for the disclosure by the principal case officer of the Prosecution Bundle and the Summary of Events to the applicant’s parents. 

The applicant’s appeal

32.  The applicant’s appeal was heard over two days by the AAB consisting of Mr Alan Ng Man-sang, Deputy Chairman, Mr So Yiu-wing, Member, and Professor Cheung Siu-yin, Member. 

33.  The AAB handed down a written decision with reasons in which it set out in considerable detail the background to the case, the legislative and policy framework of privacy protection of personal data, and the reasons for the decision of the Privacy Commissioner, before addressing the argument advanced by the applicant and providing reasons for its decision dismissing the appeal. 

34.  It should be noted that the AAB explained in its decision that the applicant had not formulated grounds of appeal as required but instead provided a lengthy narrative which was akin to “a lengthy submission or a witness statement”.  This tended to be repeated in the papers filed in the present application.  

35.  The AAB nevertheless summarised the applicant’s grounds which briefly stated that PathFinders would have been involved in or known of the disclosure of the materials by the principal case officer who would not have had access to the applicant’s personal data if she had not been an employee of PathFinders. 

36.  So it was clear from the nature of the complaint and the issue to be decided by the AAB, that the gravamen of the appeal was whether there was prima facie evidence that PathFinders at the material time was a data user as defined by the Ordinance, and whether there was prima facie evidence that PathFinders was liable for the actions of the principal case officer in disclosing the Prosecution Bundle and the Summary of Events to the applicant’s parents in her email of 2 August 2014.

37.  The AAB noted that the only act complained of by the applicant was the disclosure of the Prosecution Bundle and the Summary of Events by the principal case officer to the applicant’s parents on 2 August 2014.  The AAB went on to address whether PathFinders was at the material time a data user.  They concluded as follows:

“46.  In our view, there is no evidence to substantiate the suggestion that PathFinders either alone or jointly or in common with other persons, controlled the collection, holding, processing or use of the data contained in the Prosecution Bundle. If we are required to make a finding at this stage, we are more inclined to accept that PathFinders did not collect or possess the Prosecution Bundle at any stage.

47.  Accordingly, we agree with the Respondent that PathFinders was not at the material time a data user.  On this ground alone, the appeal should be dismissed.”

38.  Even though the AAB found that PathFinders was not a data user, they went on to consider whether PathFinders was liable for the principal case officer’s act of disclosure. After a lengthy analysis of the issue, they concluded as follows:

“52.  In our view, there is no iota of evidence to suggest that [the principal case officer] was authorized in whatever way by PathFinders to disclose the Prosecution Bundle and the Summary of Events to the Appellant’s parents in the 2/8/14 Email. Accordingly, there is no evidence to suggest that PathFinders was liable to the Appellant for the alleged disclosure made by [the principal case officer] on 2^nd August 2014, i.e. breach of Data Protection Principle 3(1).”

The grounds for judicial review

39.  The applicant complains that the decision of the AAB was unreasonable and irrational.  She lists numerous alleged errors that she claims were contained in the decision as a result of the AAB failing to take into account relevant matters. 

40.  In the papers filed by the applicant, she did not seek an oral hearing in accordance with Practice Direction SL-3.  This matter was brought to her attention by the Court, whereupon she requested an oral hearing.

41.  At the oral hearing, the applicant relied on the papers that she filed, although these mainly consisted of a selection of extracts of submissions and other papers filed in the appeal. It was noted that the Summary of Events, the subject of her complaint, was not amongst the documents. 

42.  At the hearing, the applicant distilled her grounds for judicial review into the following two points. 

43.  First, the AAB erred in its finding of fact as to when the Prosecution Bundle was received by PathFinders.  She argues that a copy of the Prosecution Bundle was given to the principal case officer at about the time it was received in March 2014 and this was done when the principal case officer was acting as a representative of PathFinders.  She further argues this was a material error because the evidence supported that PathFinders was in possession of the Prosecution Bundle at a time prior to when it was disclosed by the principal case officer. 

44.  Secondly, the AAB erred in not evaluating or finding that the Summary of Events contained data held by PathFinders dating back to 2011. 

45.  The applicant submits that the AAB erred in addressing these factual matters and as a consequence did not consider or find that PathFinders was either in possession of the data at the relevant time or liable for the actions of the principal case officer who was acting on its behalf.  As a result, the applicant complains that the AAB wrongly found that the disclosure was made by the principal case officer in her private capacity. 

Discussion

46.  It is well understood that a court in judicial review proceedings performs a supervisory role concerned with the legality of the decision or act of the public authority under review.  Where the subject of the judicial review seeks to impugn a decision of a public authority, it is important to recognise that judicial review is not a reconsideration of the merits of the decision but a challenge to the lawfulness of the decision that was made.  Therefore, the court is not concerned with whether it would have come to a different decision for it may be legitimately open to the decision maker to have decided more than one way.  It therefore turns on the question as to whether within the parameters of the law the AAB properly directed has made a decision that was not reasonable for it to make. 

47.  As to the first point, the AAB did consider the issue and explained the basis of its decision that PathFinders was not at the material time a data user, but more particularly that it was not in receipt of the Prosecution Bundle.  The relevant paragraphs stated:

“44.  However, there is no evidence to support any allegation that PathFinders collected and/or received the Prosecution Bundle in March 2014. It is more probable that it was the legal team (i.e. solicitors) representing the Appellant on a pro bono basis who collected and received the Prosecution Bundle on behalf of the Appellant. In the Appellant’s criminal case, the Appellant was the client of the legal team (solicitors and counsel) and the solicitors collected and/or received the Prosecution Bundle qua agent on behalf of the Appellant. It is also more probable that it was the legal team (solicitors and counsel) who would hold, process or use the data contained in the Prosecution Bundle before and after the District Court criminal trial.

45.  Although it is undisputed that the Prosecution Bundle fell into the hands of [the principal case officer] in August 2014 so that she could prepare the Summary of Events to help the Appellant’s parents to defend the Custody Action, this does not necessarily mean that because [the principal case officer] was the Co-founder and Director of PathFinders, PathFinders can be said to be in control of the holding, processing or use of the Prosecution Bundle and the data contained therein. This was particularly so where on either the PathFinders’ or the Appellant’s case, the working relationship between [the principal case officer] and the Appellant had already ended in August 2014.  We do not accept for one moment the submission of the Appellant at the hearing on 5^th May 2016 that although [the principal case officer] had withdrawn her support from the Appellant in April 2014 and the last time she had contact with [the principal case officer] was in May 2014, her relationship with PathFinders nevertheless still persisted.  Furthermore, the Appellant admitted in the 3/3/15 Letter that on this matter, [the principal case officer] assisted her parents in her personal capacity.”

48.  The applicant directed my attention to an extract from her submission before the AAB where she stated that at the time she consented to the principal case officer receiving her Prosecution Bundle, she believed the principal case officer was acting in her capacity as an officer of PathFinders and subject to the confidentiality agreement that she had with PathFinders. 

49.  The AAB disagreed and made a finding that was open to it to make on the evidence before it that the principal case officer was acting in her personal capacity when dealing with the applicant in relation to these matters, including the obtaining of the Prosecution Bundle. 

50.  It would appear that the view was taken that PathFinders during the period it was providing services to the applicant had not received the Prosecution Bundle, other than when the applicant gave access to or copy of the Prosecution Bundle to the principal case officer.  However, it was held by both the Privacy Commissioner and the AAB, that the applicant did this when she was dealing with the principal case officer in her personal capacity. 

51.  The basis of the applicant’s point is that she does not agree with the AAB’s finding or the reasoning for it as set out in the above paragraphs. 

52.  As to the second point, the applicant claims, that the AAB did not address whether the principal case officer used her personal data held by PathFinders in her Summary of Events.  It is not in dispute that the AAB was aware that the disclosure concerned both the Prosecution Bundle and the Summary of Events, the latter having been prepared by the principal case officer. 

53.  The applicant submits that the Summary of Events contained data that was held by PathFinders dating back to 2011.  The first point I make about this issue is that I have not been supplied with the copy of the Summary of Events and the data that the applicant claims was held by PathFinders and used by the principal case officer when she submitted her email on 2 August 2014 to the applicant’s parents.  The principal case officer stated in her email that she was providing the information in her personal capacity and not in her capacity at PathFinders.  She mentions that PathFinders withdrew support from the applicant and that the applicant gave her permission in her personal capacity to share information with her parents.   

54.  The AAB was aware of the issue raised by the applicant but by its decision it found that the disclosure by the principal case officer was done in her personal capacity.

55.  The applicant drew my attention to an extract from what appears to be part of a written submission on behalf of the Privacy Commissioner, where it is stated that the principal case officer is a director of PathFinders and any act she does on its behalf would be treated as done by PathFinders pursuant to section 65(1) of the Ordinance. However, it goes on to say, quite importantly, that any act done in the principal case officer’s private capacity will not be treated as an act of PathFinders.  That was clearly an issue that the Privacy Commissioner addressed as well as one that the AAB addressed in its decision. 

56.  The AAB stated in its decision:

“49.  Another question in the present appeal is whether [the principal case officer] had the express, implied or ostensible authority of PathFinders to disclose the Prosecution Bundle and the Summary of Events to the Appellant’s parents in the 2/8/14 Email.

50.  In the present appeal, there is no evidence to the effect that [the principal case officer] had the express or implied authority of PathFinders so to do. In our view, the evidence is against the existence of such express or implied authority for the following reasons:-

(a)  The Appellant’s parents were not clients of PathFinders.

(b)  Such disclosure was certainly against the interest of the Appellant and would run counter to the Privacy Policy which prescribes the privacy principles that PathFinders has maintained, including that “[w]e will not disclose your personal data to any external organization unless we have your consent or are required by law or have previously informed you”.

(c)  On either the PathFinders’ or the Appellant’s case, the working relationship between [the principal case officer] and the Appellant had already ended in August 2014. So was the relationship between PathFinders and the Appellant.

(d)  Our inclination to accept that PathFinders did not collect or possess the Prosecution Bundle at any stage.

51.  There is also no evidence that [the principal case officer] had the ostensible authority of PathFinders to disclose the Prosecution Bundle and the Summary of Events to the Appellant’s parents in the 2/8/14 Email. The overwhelming evidence is that when [the principal case officer] disclosed the Prosecution Bundle and the Summary Facts to the Appellant’s parents on 2^nd August 2014, she did so in her personal capacity, and that [the principal case officer], the Appellant’s parents and even the Appellant knew about this at the material time.

(a)  In the email by the Appellant’s father to [the principal case officer] dated 1^st August 2014 asking for the latter to prepare a statement to defend the Custody Action and to provide him with some information, the Appellant’s father expressly addressed [the principal case officer] in her personal capacity by bracketing the word “personal” after the name of [the principal case officer].

(b)  In the 2/8/14 Email, [the principal case officer] clearly and unambiguously stated that she sent the Prosecution Bundle and the Summary of Events in her personal capacity and not in her capacity at PathFinders, and that PathFinders withdrew support from the Appellant well over a year ago.

(c)  The Appellant admitted in the 3/3/15 Letter that [the principal case officer] assisted her parents in her personal capacity.”

Conclusion

57.  The AAB addressed the material issues in relation to the appeal before it, namely whether PathFinders, either in its own right or through its representative, disclosed the applicant’s personal data that it held by or through the email of 2 August 2014. 

58.  The AAB found that PathFinders was not liable and gave detailed reasons for its findings and decision.  It cannot be said that the decision of the AAB was either unreasonable or irrational. 

59.  The question for this Court is whether the application is reasonably arguable in order for leave to be granted to apply for judicial review.  From my overall assessment of the applicant’s submissions and papers filed with the Court, I am not of the view that the application is reasonably arguable.  I therefore refuse the application.