BEST BUY ELECTRIC COMPANY LTD v. BUILT-IN PRO LTD

HCA 1002/2024

[2025] HKCFI 4728

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

ACTION NO 1002 OF 2024

____________________

____________________

________________________

DECISION

_______________________

Introduction

1.  By summons dated 12 August 2024 (“the Summary Judgment Summons”), Best Buy Electric Company Limited (“P”) applies for summary judgment against Built-In Pro Limited (“D”).

2.  On 9 May 2025, this court handed down a decision[1] (“the Injunction Decision”) for the disposal of P’s summons for interlocutory injunctions and other interlocutory reliefs (“Injunction Summons”).  In this Decision, I shall adopt the same abbreviations used in the Injunction Decision unless otherwise stated.

3.  The background facts are narrated and a summary of the parties’ evidence is given in the Injunction Decision and I shall not repeat them here.  This Decision should be read in conjunction with the Injunction Decision.  Briefly stated, the core complaint of P is that D, its direct trade rival, hacked its DQS to gain unauthorised access to AWS Cloud Database and hence the Quotations and the Confidential Information for its commercial purpose.

4.  I provided my assessment of the parties’ respective claims in the Injunction Decision with my analysis of the parties’ evidence in the Injunction Decision.  I concluded in the Injunction Decision that P has shown a strong case of breach of confidence against D.

5.  For the purpose of the Summary Judgment Summons, the parties rely on their evidence filed for the Injunction Summons.  After the Injunction Summons, D filed the 6^th Affirmation of Lee Hui Kiu on 13 June 2025 to fulfil its disclosure obligations imposed by this court in the Injunction Decision.

6.  The parties have not changed their legal representations. Mr Tsui, for P, indicates that P does not rely on its claim of unlawful interference with P’s business for the purpose of the Summary Judgment Summons meaning the sole complaint under consideration is P’s claim for breach of confidence.

7.  Ms Leung, together with Ms Lau, for D, reminds this court that I shall bear in mind the differences between the threshold for the grant of an interlocutory injunction and that for the grant of summary judgment.  I agree that despite my previous assessment of the parties’ cases, I should reconsider this matter in light of counsel’s submissions and apply the appropriate test.  That said, unless otherwise stated, my analysis of the evidence in the Injunction Decision should remain valid and applicable to the present application.

Applicable principles

8.  The principles governing summary judgment applications are trite and I only need to highlight the following.

9.  Summary judgment can be granted only in clear cases. This court should not embark upon a mini-trial on the affirmation evidence of the parties but it does not mean that this court should suspend its critical faculties in its examination of the evidence.  This court should also take note of any changes or inconsistencies in D’s case, its inherent plausibility, inconsistency with contemporaneous documents and other compelling evidence to determine its credibility: Guanghua SS Holding Ltd v Lim Yew Cheng & Anor. [2022] HKCFI 1052 per Ng J at §13.

10.  Ms Leung stresses that the statement of claim must be good and complete in itself and any defect or omission in the statement of claim cannot be corrected or supplemented by affidavit evidence: Xiao Long v Great Wall Securities Limited [2019] HKCFI 2769 per Marlene Ng J.

Analysis of the purported defence

11.  The primary defence of D is that D did not hack the DQS and it downloaded the Quotations in a perfectly legitimate manner.  This defence is supported by three short paragraphs in the 4^th Affirmation of Lee Hui Kiu. I reproduce his relevant evidence below:

“15. In or about April and May 2024, I browsed the Plaintiff’s Website in the Internet Explorer browser for the checking of the prices and quotations of various items and services therein. As usual, after picking certain items, I intend to move on to the said wishlist function to obtain further information in relation to the quotation of products.  Upon clicking into the Wishlist Button on the Plaintiff’s Website, the internet browser was then directed to another webpage, with the hyperlink shown as https://hkele.com.hk/index.php?route=account/quote/getList (“the Hyperlink”).

16. The new webpage directed by the Hyperlink showed a list of quotation information, which is apparently similar to the page shown in Exhibit MCW-5 produced by the Plaintiff.  In addition, on this webpage there was a “Download” button which enable the viewers to download the quotation information concerned.

17. Throughout the whole process of browsing the Plaintiff’s Website, including the new webpage directed by the Hyperlink, there was no requirement of any registrations, logins, passwords to be input, no credentials were needed.  The whole content of the Plaintiff Website, the webpage directed by the Hyperlink, as well as the quotation information mentioned above, were readily accessible by me as a member of the general public in the public domain.”

12.  Mr Tsui draws to my attention that Mr Lee gave a different account in his 1^st Affirmation.  There, Mr Lee said he simply inputted the Hyperlink onto his internet browser and was directed to the webpage showing the Quotations.  D proffers no explanation for this change of his accounts.

13.  Mr Ma, who is a website developer having created the DQS for P, explained in his 2^nd Affirmation why the later account given by Mr Lee as to how he gained access to the Quotations is technically impossible.

14.  Mr Ma first pointed out that the Wishlist Button and the Hyperlink are independent to each other on the P’s website.  There is no algorithm or programming or any pathway in the Wishlist Button for users to be directed to the quotation system, i.e. DQS.  This design is to ensure that the quotation system is strictly used by Ps authorised staff only whilst the Wishlist Button is to be used by P’s customers and the general public.

15.  Mr Ma made an effort to test various functions of P’s website and did not find any pathway enabling users to be directed to the DQS from the Wishlist Button.  He saw no need to alter the Wishlist Button to enhance the protection of the DQS.

16.  Mr Ma further explained that the downloading of the Quotations in 5-minute interval was done via D’s Web Hosting Server with IP Address and not an internet browser as suggested by Mr Lee.  If D had used an internet browser to gain access to the DQS, the access log on P’s website would have shown the exact internet browser used by D.  This literally rebuts the first account given by Mr Lee as well.

17.  D has not sought to adduce any evidence, factual or expert, to contradict the evidence of Mr Ma.

18.  In paragraph 46 of the Injunction Decision, I concluded that the evidence of D’s hacking activities is overwhelming, particularly in light of the uncontradicted evidence of Mr Ma.  I find D’s explanations as to how it obtained access to the DQS and how it downloaded the Quotations to be incredible and incapable of belief.  On the other hand, the evidence of Mr Ma relating to his confirmation of D’s hacking activities is clear and not contradicted.  I have little hesitation in accepting his evidence.

19.  I do not accept that Mr Lee’s evidence in his 1^st Affirmation that he inputted the Hyperlink onto an internet browser and got access to the Quotations instantly.  Mr Lee has not explained how he obtained the Hyperlink at all in the first place.  I believe he could hardly give a plausible explanation for his knowledge of the Hyperlink and this is the reason why he went on to make up another account in his 4^th Affirmation.

20.  On this evidence, Ms Leung could do little to argue that D did not carry out the hacking activities.  She first submits that Mr Ma merely speculated that D had used a Web Hosting Server to automate a cyberattack against P.

21.  Mr Ma in fact has sufficiently explained why he concluded that the downloading of the Quotations in 5-minute interval was done via D’s Web Hosting Server with D’s IP Address and not by an internet browser as alleged by Mr Lee.  Mr Ma merely speculated the reason why D took this course.  His speculation is neither here nor there.

22.  Ms Leung seeks to rely on the fact that there were other instances of downloading not involving D’s IP Address.  She then submits that it is more probable than not that Mr Lee’s account is correct in that the Hyperlink is available on the webpage of P and it allowed the general public access to the DQS.

23.  I am unable to make a factual finding that D was not involved in those other instances of downloading at this stage though I cannot and should not speculate that they were in fact done by D too.  However, even if there were other hackers, it does not cause me any concern about the evidence of Mr Ma and start to doubt that the DQS was in fact accessible by clicking the Wishlist Button.

24.  Ms Leung submits that the first attempt of downloading using D’s IP Address was done by a Samsung mobile device and as a matter of common sense it is inherently improbable that one would use a mobile phone to launch a cyber-attack to obtain mass downloads from P’s website.

25.  I cannot accept this submission.  It is not incumbent upon P to provide an explanation for this unusual hacking by the use of a mobile phone. There could be a number of reasons but there is no reason for this court to surmise.  What really matters is D’s IP Address was actually used in this unusual hacking.  It should be noted that less than 12 hours later, another hacking was done by the use of a computer with D’s IP Address.

26.  Ms Leung has made an effort to attack the evidence of Mr Ma.  In the absence of any relevant evidential basis in support of her submissions, I remain unconvinced of the account of D. 

27.  I do not accept that P has failed to prove the hacking activities of D.  P does not have to identify the exact steps taken by D and all that it is required to show is, on balance of probabilities, D gained unauthorised access to the DQS leading to its downloading of the Quotations.

28.  Ms Leung reminds this court that the allegation of hacking is a serious one and asks this court to take into account the scale of D’s business operation when assessing the probabilities of D’s commitment of such an illicit act.  Ms Leung also urges this court to allow D to cross-examine Mr Ma before any finding of D’s hacking of the DQS is made.

29.  This court bears in mind that an allegation of hacking being possibly a criminal offence should be supported by cogent evidence though the standard of proof remains a civil one.  In any view, the evidence of D’s hacking is overwhelming to me.  Nothing in Ms Leung’s written submissions can make me change my conclusion in the Injunction Decision. 

30.  Mr Ma’s conclusion that Mr Lee’s account is technically impossible is supported by compelling evidence and that D hacked the DQS is an inescapable conclusion.  D simply fails its obligation to show a real defence with credible evidence.  

31.  Ms Leung relies on Coco v A.N. Clark (Engineers) Limited [1969] RPC 41 to submit again that there can be no binding obligation of confidence if that information is blurted out in public.  I cannot accept her submission.

32.  In Coco, what Megarry J (as he then was) sought to explain is the second element of a case of breach of confidence.  The judge stated the second requirement to be that the information must have been communicated in circumstances importing an obligation of confidence and no matter how secret and confidential the information, there can be no binding obligation of confidence if that information is blurted out in public or is communicated in other circumstances which negative any duty of holding it confidential.

33.  In the present case, the evidence of P, which I accept, is that the Quotations contained in the DQS were only accessible by certain staff of P.  The communication of the Confidential Information in the Quotations to the staff of P in this manner is sufficiently confidential and imports an obligation of confidence.  In paragraph 41 of the Injunction Decision, I referred to Sim Koh Fah v JBPB & Co. [2011] 4 HKLRD 45 in which Mr Recorder Anderson Chow SC (as Chow JA then was) cited the speech of Lord Neuberger of Abbotsbury MR in Imerman v Tchenguiz [2011] 2 FLR 592 at §§44 & 46 to explain why confidence should apply to D, being a hacker having obtained the Quotations without the authorisation of P.

34.  In light of my rejection of Mr Lee’s allegation that the Quotations were available for downloads in the public domain, Coco cannot assist D at all.

35.  Next, Ms Leung submits that P has failed to adduce evidence of any misuse of the confidential information by D and loss of profits allegedly suffered.  Ms Leung complains that thus far, P has failed to ascertain the extent of D’s usage of the information and how P’s business has been diverted as a result.

36.  I cannot accept her submissions that there is no evidence of D’s misuse of the information in the Quotations.  In paragraph 52 of the Injunction Decision, I gave my reason for rejecting the same submission and I should not repeat here.    

37.  As regards the complaint about the lack of evidence of actual loss of business suffered by P, I do not think that this undermines P’s claim. As explained in paragraph 54 of the Injunction Decision, P is entitled to a permanent injunction anyway to avoid further unauthorised use of the Confidential Information in the Quotations in any event. 

38.  By the Summary Judgment Summons, P seeks judgment against D on liability only.  At this stage, this court is only concerned with the issue of liability.

39.  In Auto-Treasure Ltd v Noble Diamond Ltd [1992] 1 HKC 117, Godfrey J (as he then was) explained that the practice of the Chancery Division in England and Wales is adopted by the Hong Kong courts when dealing with intellectual property cases.  Liability issues have to be determined first and if established, an inquiry as to damages or an account of profits may be ordered.  P has to make the election after D’s liability is found.

40.  In the Summary Judgment Summons, P asks for damages to be assessed. Apparently P has elected an inquiry as to damages. If judgement is given for damages to be assessed, P should in due course seek directions from a master pursuant to O.37 r.1, Rules of the High Court (“the RHC”) and the filing of points of claim and points of defence and discovery may be ordered. After discovery, P will be in a better position to particularise and prove its loss.

41.  With D’s unauthorised use of the Confidential Information, I opine that it is likely that P would suffer some loss. I cannot accept the submission that P has suffered no loss. An inquiry should be ordered.

42.  Lastly, Ms Leung submits that P should not be entitled to exemplary damages in any event.  I disagree.

43.  In paragraph 36 of the Statement of Claim, P sets out the particulars in support of its claim for exemplary damages, which include the allegation that D’s conduct was a contumelious disregard of P’s rights and efforts in compiling the Quotations and protecting their confidentiality. The evidence of D’s hacking activities amply justifies the allegation.

44.  P also pleads that further particulars would be pleaded pending discovery.

45.  In my view, this is a serious case of breach of confidence and D’s conduct is egregiously unacceptable.  P should be entitled to substantiate its claim for exemplary damages in an inquiry.

46.  For completeness, I should expressly reject Ms Leung’s submission that D is entitled to costs due to the discontinuance of P’s claim of unlawful interference pursuant to O.21 r.5, RHC. There is no application for leave to discontinue any claim under O.21 r.3, RHC. P merely does not ask for summary judgment in respect of this claim and this is a far cry from applying for leave to discontinue such a claim.

Conclusion and orders

47.  For the reasons given above and in the Injunction Decision, I find that the claim of breach of confidence is plainly made out on the evidence.  The four elements of such a claim set out in Devere Group Hong Kong Limited & Anor. v Nicholas Edward John Smith [2014] HKCFI 615 (§19) are proved on balance of probabilities.  There is no triable issue.  D is unable to show any real or bona fide defence to P’s claim.

48.  Accordingly, I accede to the application of P by the Summary Judgment Summons and enter judgment against D.  P should proceed to take steps to conduct an inquiry as to damages.   

49.  There is no reason why costs should not follow the event. I make an order nisi that the costs of this action including the present application and any costs reserved should be borne by D, to be taxed if not agreed.

50.  Last but not least, I thank Ms Leung, Ms Lau and Mr Tsui for their helpful assistance.