LAU TAK LUN v. PRIVACY COMMISSIONER FOR PERSONAL DATA

HCAL 2130/2024

[2026] HKCFI 5522

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

CONSTITUTIONAL AND ADMINISTRATIVE LAW LIST NO 2130 OF 2024

________________________

________________________

__________________

D E C I S I O N

__________________

A. Introduction

1.  By Form 86 dated 14 November 2024, the Applicant sought leave to apply for judicial review, so as to challenge the decision (“Decision”) made by the Privacy Commissioner for Personal Data (“Commissioner”) on 15 August 2024, not to carry out an investigation in relation to the “doxxing” offence under section 64 of the Personal Data (Privacy) Ordinance (“PDPO”).

2.  Along with the Form 86, the Applicant filed an affirmation, a spreadsheet exhibiting all the Applicant’s complaints, and a Bundle of Exhibits totalling over 1770 pages.

3.  In his Affirmation, the Applicant sought the following relief:

(1)  an order of certiorari to quash the Decision;

(2)  a declaration that the Decision is unlawful and of no legal effect;

(3)  an order of mandamus: (a) that the Commissioner do commence specified investigations into the Applicant’s doxxing complaints set out in Appendix A (i.e. the annexed spreadsheet), and inform the Applicant of the results of the specified investigation pursuant to section 66S PDPO; (b) that the Commissioner do take a statement from the Applicant regarding the doxxing complaints set out in Appendix A; and (c) that the Commissioner do in any event request the various social media platforms to take down the doxxing posts as set out in Appendix A which contains the Applicant and his family’s personal data;

(4)  or alternatively, an order of mandamus, that the Commissioner refers those doxxing cases as set out in Appendix A which involves suspected commission of an indictable offence under section 64(3C) PDPO to the Hong Kong Police Force for follow up and the Secretary for Justice for consideration of prosecution pursuant to the Commissioner’s Complaint Handling Policy and Part 9A of the PDPO; and

(5)  an order for costs.

4.  I gave directions giving leave to the Commissioner to file and serve an Initial Response to the application, and leave to the Applicant to file a Reply to that Initial Response.

5.  The originally envisaged timetable was significantly lengthened as a result of various factors, including the time taken for the Applicant to provide to the Commissioner a copy of the Bundle of Exhibits (which had not been provided, and given its volume, where it was impractical to make copies of at the High Court Registry), and several extensions of time granted to the parties, and a stay triggered by the Applicant’s application for legal aid (though I later lifted that stay, and declined the Applicant’s invitation to reverse that decision).

6.  Ultimately, I have since had the benefit of an Initial Response filed by Mr Martin Ho of Counsel, and the Applicant’s Reply.  I have taken both into account, together with the materials originally filed by the Applicant.

7.  Having done so, I am satisfied the application can be dealt with on the papers.  This is my decision.

B.  Background

8.  The relevant facts can be broadly summarised as follows.

9.  The Applicant was a partner of a retail business in the toy industry known as “The Qube”, which was also trading as “The Qube by Tomica Hong Kong”, since 2019.  According to the Applicant, there were some business disputes, and as a result, competitors sought to ‘dox’ the Applicant and his family on various social media platforms.  The Applicant alleges that this doxxing caused them to suffer from specified harm as defined under PDPO, and as a result they had to stay in a hotel and close all their retail shops due to fear for safety, and physical/psychological harm and distress.

10.  The Applicant first lodged a complaint with the Commissioner in July 2022.  The Commissioner commenced a specified investigation on or about December 2022 against 7 doxxing offenders, and took a statement from the Applicant.  Whilst the Commissioner concluded that the evidence was insufficient to carry out prosecution, it did request Facebook to take down the relevant posts, which was complied with (“July 2022 Specified Investigation”).

11.  The Applicant then proceeded to file many more complaints, which (as noted by Mr Ho in the Initial Response) exceeded 500 complaints.  The impugned Decision concerns 478 of those complaints, lodged between 3 August 2023 and 5 January 2024.

12.  In relation to those complaints, the Commissioner handed down eleven decisions, ten of which were appealed against by the Applicant to the Administrative Appeals Board (“AAB”).  In one of the appeals, the Commissioner’s decision was set aside.  But, notwithstanding that, the Commissioner did not commence any investigation.

13.  By letter dated 26 July 2024, the Commissioner informed the Applicant that she would withdraw the decisions and reconsider the matters holistically.  The Applicant was invited to withdraw the remaining appeals.

14.  That reconsideration resulted in the Decision.  The Decision was expressed as being that, in light of the lack of prima facie evidence showing requisite intent, the doxxing complaints do not constitute a criminal offence of “doxxing” under section 64 of the PDPO and therefore no criminal investigation would be carried out.

15.  The Applicant apparently attempted to seek further assistance from the AAB, which stated that it was functus officio, so that the Decision “conveniently” (the Applicant’s word) was outside the jurisdiction of the AAB.

16.  The Applicant also subsequently approached the Office of the Ombudsman, which apparently took the view that the Decision was one of professional judgment outside its purview of investigation.  Further, the Hong Kong Police Force considers that it would need the Commissioner to refer matters to it for an indictable offence under section 64(3C) of the PDPO, and from November 2024 closed the Applicant’s crime report.

C.   Amenability

17.  It is trite that decisions made by the Department of Justice not to prosecute are not amenable to judicial review, apart from where there is a challenge as to unconstitutionality.  This flows from Article 63 of the Basic Law (“BL 63”), which directs that the Department of Justice shall control criminal prosecutions free from any interference.  Whilst there are no fixed categories of cases where a prosecution decision may be regarded as falling outside the constitutional limits of the Secretary for Justice, examples may include (a) where the prosecuting authority has acted in obedience to political instructions, (b) where it has acted out of bad faith, or (c) where there has been rigid fettering of prosecutorial discretion.

18.  Mr Ho has drawn attention to the case of Wong Wai Yin v Buildings Department [2020] HKCFI 3011, where Chow J (as he then was) held that the same principles applied to the Buildings Department in its exercise of prosecutorial powers under the Buildings Ordinance Cap 123.  By analogy, the principles would also apply to the current situation.

19.  Indeed, I accept Mr Ho’s submission, that given the Commissioner has power under section 64C of the PDPO to prosecute doxxing offences (in relation to sections 64(1), 64(3A) of the PDPO), such prosecutorial decisions fall within the scope of BL 63.

20.  In any event, even under the Applicant’s submission made in his Reply that the present doxxing complaints fall under section 64(3C) of the PDPO – which as an indictable offence and is outside the scope of the Commissioner’s power – the relevant principles are still applicable, given that the procedure would result in the referral of the case to the Police and the Department of Justice.

21.  The Applicant submitted that the Decision currently being challenged is a refusal to carry out a criminal investigation (pre-investigation), which is distinct from a decision not to prosecute (post-investigation), and as a result, the relevant principles on amenability do not apply.  I disagree.  It seems to me that the principles applicable to a decision not to carry out a criminal prosecution are equally applicable to a decision not to commence an investigation in relation to a criminal offence.  The Commissioner, albeit acting under independent statutory powers, is responsible for tasks akin to law enforcement (e.g. Police, ICAC).

22.  It is settled that only in highly exceptional cases would the Court disturb the decisions of an independent prosecutor and investigator.  This is because the powers in question are only entrusted to the officers identified, and no other authority may exercise these powers or make the judgments on which such exercise must depend: see R (Corner House Research) v Director of Serious Fraud Office [2009] 1 AC 756, at 840F-841D.

23.  The Applicant has accepted that the Commissioner is the only authority entrusted with powers to exercise investigatory and prosecutorial powers in relation to the data privacy of individuals in Hong Kong.  As I have previously acknowledged in the past – see, for example, Yeung Wing Kit v Commissioner of Independent Commission Against Corruption [2021] HKCFI 3337 – in its judicial review jurisdiction, the Court exercises great caution in interfering with a prosecutorial decision, and that extends to potential interference with the public authority’s decision on whether to commence criminal investigations.

24.  It is also important to note that law enforcement officers, in performing their duty to bring offenders to justice, enjoy a wide margin of discretion (which include, amongst other things, whether a complaint warrants investigations, what investigative steps to take, and whether there is sufficient evidence obtained to charge a suspect or refer a case to a prosecutor).  In carrying out this discretion, officers are entitled to take into account a wide variety of factors, and the weight to be allocated to each factor is a matter for them to determine – not the Court: see In re McQuillan [2022] AC 1063.  This wide margin of discretion, in my view, applies to the Commissioner, who is tasked with overseeing the enforcement and compliance of the PDPO in Hong Kong.

25.  The Applicant does not articulate how the Decision was allegedly made in an unconstitutional manner, and – subject only to the bad faith point raised in Ground 4, below – the challenge to the Decision must fail as being not amenable to judicial review. 

D.   Grounds of Review

26.  The Applicant has advanced four intended grounds of review.  In brief, they are:

(1)  Ground 1: The Applicant had a legitimate expectation that the Commissioner would follow the same procedure and same practice in dealing with the Applicant’s doxxing complaints as it had previously done so with regards to the Applicant’s July 2022 Specified Investigation.

(2)  Ground 2: The Decision is irrational (i.e. Wednesbury unreasonable).

(3)  Ground 3: The Decision is illegal due to an error of law.

(4)  Ground 4: The Decision was made in bad faith.

27.  Bad faith is not in itself a general standalone ground of judicial review, as such.  It is a claim ordinarily made in conjunction with or as part of a claim of unreasonableness, or made for the purposes of allowing a usually non-reviewable decision to be reviewed (i.e. on a question of amenability).

28.  As I have already indicated, if the Applicant’s claim of bad faith is not made out to the standard necessary for the grant of leave to apply for judicial review, the application fails on amenability alone, and strictly I need not consider the three other intended grounds of review.  Therefore, I shall first deal with the intended ground of bad faith, before addressing the first three intended grounds advanced by the Applicant.

E.   Ground 4: Bad Faith

29.  In relation to this ground, the Applicant submitted that the Decision was made in bad faith with the improper motive of circumventing the jurisdiction of the AAB, as seen by (1) the Commissioner’s manner of handling the Applicant’s doxxing complaints since December 2021, and (2) the Commissioner’s failure to conduct any investigation after undertaking to the Applicant and the AAB to “reconsider” the Applicant’s doxxing complaints.

30.  The relevant principles governing a claim of bad faith in judicial review proceedings have been stated in my previous decision of Tang Chiu Man and Lam Ka Fun Anita v Secretary for Justice for Director of Lands [2025] HKCFI 3253 at §86, and can be stated again as follows:

(1)  “Bad faith” is not the test.  It is the conclusion at the end of the analysis.

(2)  The applicant must show that the public body’s conduct was so unreasonable or so perverse that it is akin to bad faith.

(3)  Mere faulty administration, or even administration which fails to take into account certain factors which should be taken into account, is not sufficient to show bad faith.

(4)  An ulterior motive may be indicative of bad faith, and the Court is allowed to examine those motives.

(5)  But again, an ulterior motive is not the same as merely failing to take into account relevant considerations.  The former must carry some sort of moral impropriety in that the decision-maker either knowingly pursues a purpose that is different from that being openly pursued (i.e. a sham); knowledge that the decision was for extra-legal purposes; the motive behind the decision was based on personal factors such as financial gain, revenge or prejudice; or the decision involves a degree of personal malice, vindictiveness, or animosity against a particular group or individual.

(6)  It is thus no surprise that allegations of bad faith attract a very heavy standard of proof.

(7)  A heavy burden of proof is also commensurate with the general position that serious allegations require cogent evidence.  To allow too readily some non-reviewable decisions to become reviewable would risk defeating the certainty that previous authorities have sought to promote.

31.  I do not think that there is reasonably arguably sufficient basis to claim any moral impropriety (i.e. ulterior motive) on the part of the Commissioner in relation to the Decision.  Firstly, the Applicant does not provide any explanation as to why the Commissioner would deliberately circumvent the AAB’s appeal jurisdiction just to refuse to carry out any investigation on the Applicant’s complaints.  Secondly, I do not see how it is reasonably arguable that the Commissioner, in coming to the Decision, was influenced by anything other than the merits of the application.

32.  Indeed, as submitted by Mr Ho, the Commissioner clearly articulated her reasons for coming to the Decision in both the letter to the Applicant dated 15 August 2024, and also within the related Internal Memorandum M.1 (“Internal Memorandum”).  A reconsideration of a decision does not necessitate a reversal of the decision.  An offer or undertaking to “reconsider” a decision does not mean an offer or promise to reverse it.  The Commissioner, as a responsible public authority, is perfectly entitled to reconsider her position, and such an approach actually shows a degree of flexibility and open-mindedness, rather than any intention to maintain a decision “through thick and thin”.  As it happens, after reconsideration of the information available and the circumstances of the cases, the Commissioner nevertheless came to the same conclusion.

33.  The Applicant, in his Reply, sought to provide a number of explanations to further support the allegation of bad faith.  However, I see no reasonably arguable merit in any of those points, as they are either premised on misunderstandings of fact and law, or provide no sufficient value to support an allegation of bad faith.

34.  For instance, the Applicant contended that it is in the Commissioner’s submission that the Applicant “sold fake toys”, and defamatory statements are evidence that the Commissioner was clearly acting in bad faith. I do not accept that argument.  The Commissioner was simply referring to the nature of the allegations made by the Facebook posters.

35.  The Applicant tried to point out that there is a contradiction between the Commissioner’s submissions, which say that the complaints were premised on “fake toys”, and the Commissioner’s previous finding that the complaints were premised on “monetary disputes”.  Firstly, this is incorrect, as the Internal Memorandum refers to both “fake toys” and “monetary disputes” with regards to the factual background and context against which the complaints arose.  Secondly, in any event, this is not indicative of any bad faith.

36.  Other explanations ranged from suggestions that the Commissioner “wilfully ignored” certain pieces of legislation and evidence, to suggestions that in substantiating her case the Commissioner was acting in bad faith by citing English cases instead of Hong Kong cases.

37.  With respect, these arguments may well exhibit the degree of the Applicant’s dissatisfaction with the Decision – which may also be seen by the Applicant describing the Decision as an “elaborated hoax”.  But they do not shed any light as to how the Commissioner allegedly came to hold an ulterior motive against the Applicant, or how the Decision is so unreasonable that it is akin to bad faith.

38.  As a result, I do not think the matters advanced by the Applicant are reasonably arguable capable of meeting the high standard of proof required for bad faith on behalf of the Commissioner.  The Decision is, therefore, not amenable to judicial review.

39.  Nevertheless, for the sake of completeness, I shall continue to address each of the remaining grounds.

F.  Ground 1: Legitimate Expectation

40.  The Applicant’s first ground is that he reasonably held a legitimate expectation that the Commissioner would follow the same procedure and practice in handling the Applicant’s doxxing complaints as she previously did in relation to the Applicant’s July 2022 Specified Investigation.

41.  This legitimate expectation, the Applicant submitted, arose both from express representations set out in Part 9A, sections 64 and 66S of the PDPO and in §17 of the Commissioner’s Complaint Handling Policy, and impliedly from the Commissioner’s conduct in the handling of the Applicant’s July 2022 Specified Investigation (which, involved the taking of a statement from the Applicant and conducting a specified investigation that is in line with the procedure adopted by other law enforcement agencies).

42.  I do not think there is any force in this argument.  The documents referred to by the Applicant – namely the PDPO and the Commissioner’s Complaint Handling Policy, do not provide that the Commissioner must initiate a criminal investigation regardless of merit in the complaint.  In fact, it states the contrary – §8 of the Policy not only refers to the discretion of the Commissioner to refuse to carry out an investigation under section 39(2) PDPO, but also provides further explanation as to how the Commissioner exercises this discretion.  For example, it states that under section 39(2)(d) PDPO, the Commissioner may find an investigation (or further investigation) unnecessary, where after preliminary enquiry by the Commissioner, there is no prima facie evidence of any contravention of the requirements under the PDPO.

43.  I also do not see any reasonably arguable basis for this expectation to have arisen from the Commissioner’s previous handling of a complaint.  If the Commissioner is to address every complaint with a specified investigation without any regard as to its merits, it would not only be imposing an onerous workload on the Commissioner – it would also neuter the Commissioner’s discretion under section 39 of the PDPO.

44.  Thus, Ground 1 is not reasonably arguable with any realistic prospect of success.

G.  Ground 2: Irrationality

45.  Under his second ground, the Applicant submitted that the Commissioner’s decision not to commence any specified investigation regarding the doxxing complaints is “so outrageous and unreasonable that no law enforcement body could ever have come to it”.

46.  In support, the Applicant claimed that the Commissioner has a statutory duty under the Victims Charter to provide professional investigation of every report of crime by a victim, and that it is also unreasonable for the Commissioner to place the burden on applicants to provide prima facie evidence before the complaints can be investigated.

47.  I do not accept this submission as giving rise to a reasonably arguable point.  Firstly, it has to be noted that the Victims Charter is merely an administrative guide set out by the Department of Justice, and does not serve as statutory guidance for the Commissioner (which, instead, is found in the PDPO).

48.  Secondly, the Applicant submitted that section 39 of the PDPO does not explicitly state “lack of prima facie evidence” as a valid reason for the Commissioner to refuse to carry out an investigation.  But as I have mentioned above, section 39(2)(d) of the PDPO allows the Commissioner the discretion to refuse investigation using this reason, which is explicitly mentioned at §8 of the Commissioner’s Complaint Handling Policy.

49.  I also accept Mr Ho’s submission that this is a matter of professional judgment for the Commissioner – particularly in determining whether the materials provided justify the expenditure of public resources in conducting investigations on the Applicant’s complaints, given that the Commissioner’s duty is in part to reduce the massive drain on the PCPD’s limited complaint and legal assistance application handling resources (see §19 of the Complaint Handling Policy).

50.  I am not persuaded that it is reasonably arguable that the Decision made was one not reasonably open to the Commissioner.  A reading of the Internal Memorandum clearly shows that the Commissioner made the Decision after a substantial consideration of the evidence available (in particular, the posts and comments, and the data disclosed therein).

51.  It was found that some of the disclosed data were information in relation to the Applicant’s business that was publicly available (and thus not private personal data), and some of the data did not directly or indirectly permit a person to ascertain the Applicant’s identity.  It was also found that these posts and comments were made in relation to the comments and dissatisfaction of the business mode of The Qube and of the Applicant.

52.  As Mr Ho fairly accepted, there may be legitimate difference in views amongst reasonable people on what and whether investigations might commence.  But that does not mean that the Decision was one which no reasonable public authority in the Commissioner’s position was entitled to make.  Certainly, I do not see how the Commissioner has, as put forward by the Applicant, “turned a blind eye” towards the numerous doxxing complaints.

53.  Hence, Ground 2 is not reasonably arguable with any realistic prospect of success.

H.  Ground 3: Illegality

54.  The Applicant’s third ground was essentially an extension of his second ground, being premised on the Commissioner’s comment on the lack of “prima facie” evidence in relation to the requisite mens rea element of the doxxing offence.

55.  The Applicant argued that the Commissioner made an error of law, as the duty to provide evidence is not on him – rather, as a victim, he merely has to provide reasonable suspicion that a suspected crime has occurred, which in this case, is achieved by lodging a complaint with the Commissioner.

56.  I disagree.  There is no legal basis which supports any threshold requirement for the Commissioner to commence any criminal investigations.  A reading of the statute displaces this argument.  Section 39 of the PDPO provides that the Commissioner has the discretion to refuse to commence any investigation, so long as one of the listed reasons are present – in this case, section 39(2)(d), which allows for the Commissioner to take into consideration the lack of prima facie evidence.

57.  Further, the Applicant is essentially submitting that all complaints must result in investigations by the Commissioner.  As noted earlier, this would be an abuse of public resources and would also directly contravene section 39 PDPO.

58.  Therefore, the matters raised by Ground 3 do not identify any reasonably arguable illegality challenge with any realistic prospect of success.

I.   Result

59.  As stated above, the application fails on amenability alone.  In any event, had the Decision been amenable to judicial review, the Applicant has also failed to show any reasonable arguable public law grounds of review with any realistic prospect of success.

60.  The Applicant’s application for leave to apply for judicial review is hence dismissed.  I make no order as to costs.