THE COMMISSIONER OF POLICE v. THE PRIVACY COMMISSIONER FOR PERSONAL DATA

CACV 229/2011

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF APPEAL

CIVIL APPEAL NO 229 OF 2011

____________

____________

________________________________

REASONS FOR JUDGMENT

________________________________

Hon Kwan JA:

1. This is the hearing of a case stated by the Administrative Appeals Board (“the Board”) on 21 October 2011 pursuant to section 24(1) of the Administrative Appeals Board Ordinance. Under this provision, the Board may, before an appeal is determined, refer any question of law arising in the appeal to the Court of Appeal for determination by way of case stated.

2. The question of law referred to this court for determination is as follows:

“Whether, upon the true construction of s 19(1) of the Personal Data (Privacy) Ordinance, Cap 486, it is legally permissible for a data user, in compliance with a data access request made under s 18(1)(a) of the Ordinance, to inform the individual, or relevant person on behalf of the individual, verbally, instead of in writing, that the data user does not hold personal data of which the individual is the data subject.”

Background facts

3. The relevant background facts for present purpose, taken from the case stated, may be briefly stated as follows.

4. On 6 October 2007, the complainant made two data access requests (“DARs”) to the Hong Kong Police Force under s 18(1) of the Personal Data (Privacy) Ordinance (“the Ordinance”) on his own behalf and on behalf of his son for “police data regarding offences or convictions” for the period from 2004 to 2007.  The DARs were made in a form specified by the Police under the Ordinance.  At the request of the Police to clarify the kind of police report he was requesting, the complainant replied on 8 October stating that he wished the Police to “confirm in writing” they “do not hold any records of criminal offences or convictions for [the complainant and his family] (period 2004 – 2007 inclusive)”, and if the Police should hold any such records, they were requested to supply the date and nature of the offence.

5. The Police responded to the complainant on 9 October 2007 advising that they provided two kinds of services, namely:

(1)  Certificate of No Criminal Conviction (“CNCC”)

An application for CNCC should be made in person in the Police office.  If the applicant is not in Hong Kong, the application may be made by post provided that certain documentary requirements were fulfilled.  If no criminal conviction is found, the CNCC will be sent to the relevant consulate or immigration authority.

(2)  Criminal Conviction Data (“CCD”) Access

Again, the applicant should make the request in person in the Police office, with his identification document.  If no criminal conviction is found, the applicant will be notified verbally of the result.  If a criminal conviction is found, the applicant will be given a summary of the conviction.  A fee of $50 is payable for each application.

6. The complainant was not applying for a CNCC.  On 9 October 2007, the complainant replied to the Police saying that he regarded the Police as denying his requests.  The Police did not hold any conviction data in respect of the complainant or his son and took the position that section 18 of the Ordinance only required them to “inform” the complainant they did not hold the data requested and they would do so verbally in accordance with their established procedure.  They invited the complainant and his family to come to the Police office to have CCD Access and be verbally informed of the result.

7. The complainant disagreed with the position taken by the Police and made a complaint to the Privacy Commissioner for Personal Data (“Privacy Commissioner”) on 15 November 2007.

8. On 31 December 2007, the Privacy Commissioner notified the complainant that he had decided not to carry out or continue an investigation into the complaint, as he was of the view that section 18 did not require the Police to inform the complainant in writing whether they held the data requested and a verbal reply would be sufficient.  The complainant had declined to attend the Police office so that he could be verbally informed.  The Privacy Commissioner found there was no contravention of s 18(1)(a) and s 19 of the Ordinance.

9. The complainant appealed to the Board against the decision of the Privacy Commissioner.  This is Administrative Appeal No 1 of 2008 (“the 1^st Appeal”).

The 1^st Appeal

10. The Board handed down its decision on 10 December 2008 and allowed the appeal.  They did not agree with the Privacy Commissioner’s interpretation of s 18(1)(a), for the reasons which appeared in paras 16 to 18 of the decision:

“16. … Section 18 provides for the right of an individual to have access to personal data held by the data user and where the data user holds no such data, the right of the requestor to be informed of this fact by the data user. Section 18 does not provide for the manner to comply with a data access request. The fact that ‘inform’ in section 18(1)(a) is not qualified, without more, does not enable the data user to comply with the request by verbal means.

17. The data user’s duty to comply with an access request and the manner of compliance are provided under section 19. The data user is required to supply a copy of the data within 40 days of receiving the request if he holds the data and if he does not hold such data, he is required to let the requestor know about it within the same period of time. If the data user is unable to do both, he has to inform the requestor in writing about it and the reason why. Sections 19(3) and (4) also provides that notice to the requestor on correction of data supplied and notice that the data user is unable to supply the data in the form requested, have to be in writing.

18.  In our opinion, bearing in mind that a data access request is required to be made in writing and a data correction request is also required to be made in writing, and further section 19 requires notices to the requestor to be in writing, it would be unreasonable, if not absurd, to suggest that a requestor need only be verbally informed by a data user that no personal data of his are held without being inconsistent with the requirements of section 19.”

11. The Board remitted the case to the Privacy Commissioner to continue his investigation.

12. On 15 April 2010, the Privacy Commissioner issued a Result of Investigation of the complaint and made, inter alia, the finding that the Police’s failure to provide a written reply to the complainant’s DARs contravened s 19(1) of the Ordinance.  The Privacy Commissioner issued an enforcement notice the same day, requiring the Police to inform the complainant in writing that they do not hold the data requested under the DARs, within 21 days after service of the enforcement notice.

13. On 28 April 2010, the Commissioner of Police lodged an appeal against the Privacy Commissioner’s decision.  This is Administrative Appeal No 10 of 2010 (“the 2^nd Appeal”) and was heard by a differently constituted Board.

The 2^nd Appeal

14. The Board handed down its decision on 5 May 2011. The core issue was whether the Police, in order to comply with the complainant’s DARs under s 18(1)(a), must give a written reply where the Police do not hold any relevant criminal conviction data.  The Board considered whether it is legally permissible for the Police to give a verbal reply that they do not hold any relevant personal data is a question of law the answer to which would depend on the true construction of s 19(1).  Although the Privacy Commissioner originally shared the view of the Police regarding the proper construction of s 19(1), the Privacy Commissioner considered himself bound by the decision of the Board in the 1^st Appeal.  Counsel for the Privacy Commissioner submitted it would cause a chaotic situation if the Board in the 2^nd Appeal were to come to a different conclusion from the Board in the 1^st Appeal.  In view of this, and as the question raised is of great general importance, the Board decided to refer the question of law for determination by the Court of Appeal by way of case stated. 

The statutory provisions

15. We are concerned with ss 18 and 19 of the Ordinance.  I set out the relevant parts in full:

“18. Data access request

(1) An individual, or a relevant person on behalf of an individual, may make a request-

(a)  to be informed by a data user whether the data user holds personal data of which the individual is the data subject;

(b)  if the data user holds such data, to be supplied by the data user with a copy of such data.

(2)  A data access request under both paragraphs of subsection (1) shall be treated as being a single request, and the provisions of this Ordinance shall be construed accordingly.

(3)  A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to the contrary, be treated as being a data access request under both paragraphs of that subsection, and the provisions of this Ordinance (including subsection (2)) shall be construed accordingly.

…”

(Emphasis supplied)

“19. Compliance with data access request

(1) Subject to subsection (2) and sections 20 and 28(5), a data user shall comply with a data access request not later than 40 days after receiving the request.

(2) A data user who is unable to comply with a data access request within the period specified in subsection (1) shall-

(a)  before the expiration of that period-

(i)  by notice in writing inform the requestor that the data user is so unable and of the reasons why the data user is so unable; and

(ii)  comply with the request to the extent, if any, that the data user is able to comply with the request; and

(b)  as soon as practicable after the expiration of that period, comply or fully comply, as the case may be, with the request.

(3)  A copy of the personal data to be supplied by a data user in compliance with a data access request shall-

(a)  be supplied by reference to the data at the time when the request is received except that the copy may take account of-

(i)  any processing of the data-

(A)  made between that time and the time when the copy is supplied; and

(B)  that would have been made irrespective of the receipt of the request; and

(ii)  subject to subsection (5), any correction to the data made between that time and the time when the copy is supplied;

(b)  where any correction referred to paragraph (a)(ii) has been made to the data, be accompanied by a notice stating that the data have been corrected pursuant to that paragraph (or words to the like effect); and

(c)  as far as practicable, be-

(i)  intelligible unless the copy is a true copy of a document which-

(A)  contains the data; and

(B)  is unintelligible on its face;

(ii)  readily comprehensible with any codes used by the data user adequately explained; and

(iii)  in-

(A)  subject to sub-subparagraph (B), the language specified in the request or, if no language is so specified, the language in which the request is made (which may be the Chinese or English language in either case);

(B)  a language other than the language specified in the request or, if no language is so specified, the language in which the request is made, if, but only if-

(I)  the language in which the data are held is not the language specified in the request or, if no language is so specified, the language in which the request is made, as the case may be; and

(II)  subject to section 20(2)(b), the copy is a true copy of a document which contains the data;

(iv)  without prejudice to the generality of subparagraph (iii) but subject to subsection (4), be in the form, or one of the forms, if any, specified in the request;

(v)  where subparagraph (iv) is not applicable, in such form as the data user thinks fit.

(4)  Where-

(a)  a data access request specifies the form or forms in which a copy of the personal data to be supplied in compliance with the request is or are sought; and

(b)  the data user concerned is unable to supply the copy in that form or any of those forms, as the case may be, because it is not practicable for the data user to do so,

then the data user shall-

(i)  where there is only one form in which it is practicable for the data user to supply the copy, supply the copy in that form accompanied by a notice in writing informing the requestor that that form is the only form in which it is practicable for the data user to supply the copy;

(ii)  in any other case-

(A)  as soon as practicable, by notice in writing inform the requestor-

(I)  that it is not practicable for the data user to supply the copy in the form or any of the forms, as the case may be, specified in the request;

(II)  of the forms in which it is practicable for the data user to supply the copy; and

(III)   that the requestor may, not later than 14 days after the requestor has received the notice, specify in writing one of the forms referred to in sub-subparagraph (II) in which the copy is to be supplied; and

(B)  as soon as practicable, supply the copy-

(I)  in the form specified in the response, if any, to the notice referred to in subparagraph (A);

(II)  if there is no such response within the period specified in subparagraph (A)(III), supply the copy in any one of the forms referred to in subparagraph (A)(II) as the data user thinks fit.

…”

(Emphasis supplied)

The approach to statutory interpretation

16. The established principles are conveniently set out in HKSAR v Cheung Kwun Yin (2009) 12 HKCFAR 568 at paras 12 to 14.  In summary, the court adopts a purposive interpretation.  The statutory language is construed having regard to its context and purpose, and words are given their natural and ordinary meaning unless the context or purpose points to a different meaning.  Context and purpose are considered when interpreting the words used, not only when an ambiguity may be thought to arise.

17. The context of a statutory provision should be taken in its widest sense and certainly includes the other provisions of the statute and the existing state of the law.  The purpose of a statutory provision may be evident from the provision itself.  The purpose may also be ascertained from a report where the legislation implements the recommendations of the report, the explanatory memorandum to the bill, a statement in the Legislative Council by the responsible Government official in relation to the bill.

18. Our attention was also drawn to the general interpretative principle that the court presumes, unless the contrary intention appears, that the legislator intended to conform to legal policy, which is based on public policy (Bennion on Statutory Interpretation, 5^th ed, page 769).  Relevant aspects of legal policy for present purpose would include the basic principles that law should serve the public interest (Bennion, pages 779 and 786) and that it should be certain and predictable (Bennion, page 799 and the principle against doubtful penalisation, namely that a person should not be penalised except under clear law (Bennion, pages 784 and 825 to 831). 

Construing the statutory provisions

19. Miss Ismail, who appeared for the Commissioner of Police, in a well reasoned submission, took us through the construction exercise with regard to the natural and ordinary meaning of ss 18 and 19, the context of these provisions, and the purpose and public policy of these provisions. I shall follow the same scheme in her submission.

The natural and ordinary meaning

20. Miss Ismail submitted where compliance with a data access request under s 18(1)(a) is required by s 19(1), the request would be complied with by the data user once the requestor is “informed”.  Neither s 18(1)(a) nor s 19(1) makes provision for the manner of compliance with a data access request beyond what is stated in s 18(1)(a), namely, that the requestor is “to be informed”.  The natural and ordinary meaning of “to be informed” is to be told or given information, whether in writing or verbally or otherwise (The Oxford English Dictionary, 2^nd ed, Vol VII, definitions of “inform” at pages 942 to 943 and “informed” at page 947).

21. I do not understand Mr Kwok Sui Hay, who appeared for the Privacy Commissioner, to have contended otherwise.

The context

22. S 19(1) requires a data user to comply with a data access request within 40 days unless: (a) the data user is unable to comply with this temporarily (as addressed in s 19(2)); or (b) where s 20 applies, namely, if one or more of the circumstances exist in which a data user shall or may refuse to comply with a data access request; or (c) where s 28(5) applies, in which a data user may refuse to comply with a data access request unless and until any fee imposed by the data user for complying with the request has been paid.

23. Miss Ismail submitted it is clear that none of the above exceptions apply in the present case.  There is no controversy about the situations in (b) and (c).  But Mr Kwok argued that the present case does fall within (a).  I will come back to his argument.

24. Miss Ismail went on to submit that whilst various provisions in s 19 contain express requirements for certain matters to be notified in writing to the requestor in particular instances, no such requirement is expressed in respect of providing information as to a lack of personal data pursuant to a data access request under s 18(1)(a).  We were taken through the relevant provisions in s 19(2) to (4).

25. S 19(2)(a)(i) provides for the situation where the data user is temporarily unable to comply with the data access request within 40 days after receiving the request.  In that case, the data user shall before the expiration of the 40-day period, by notice in writing inform the requestor he is so unable and the reasons why he is so unable.  S 19(3)(b) covers the situation in which personal data are to be supplied and where correction has been made to the data.  In that case, the data supplied to the requestor are to be accompanied by a notice stating that the data have been corrected.  S 19(4)(b) governs the situation where the data access request specifies the form or forms in which a copy of the personal data to be supplied is sought and the data user is unable to supply the copy in that form or any of those forms.  Where there is only one form in which it is practicable for the data user to supply the copy, the data user shall supply the copy in that form accompanied by a notice in writing informing the requestor of this.  In any other case, the data user shall by notice in writing inform the requestor it is not practicable to supply the copy of the personal data in the form or any of the forms specified in the request, and of the forms in which it is practicable to supply the copy.

26. Hence, none of the above situations in which notice in writing is required would appear to apply to the present case, where the Police do not hold the relevant personal data requested under s 18(1)(a).  In paras 17 and 18 of the decision in the 1^st Appeal, the Board reasoned that as notice to the requestor is required to be given in writing in various situations in s 19(2), (3) and (4), and as the data access request is required to be in writing, it would be unreasonable if not absurd to suggest that the requestor would only need to be verbally informed in the present case where no relevant personal date are held without being inconsistent with the requirements of section 19.  I do not agree with this reasoning.  There is no unreasonableness, absurdity or inconsistency involved.  The situations in which written notice is required do not apply to the present case.  I should add that the Board in the 1^st Appeal did not have the benefit of full legal submissions as the Police were not legally represented.

27. Next, Miss Ismail pointed out that in the Ordinance, the draftsman has adopted at least four different formulae: (a) “be informed”, “to inform” (as in ss 18(1)(a), 34(1)(i), Schedule 1 paras 1(3), 2(1)(c), 5(b) and (c), Schedule 5 para 6); (b) “informed in writing” (as in ss 56(i) and (ii)); (c) “by notice in writing inform” (as in ss 19(2)(a)(i), 19(4)(i) and (ii), 21(1), 23(2)(a), 25(1), 39(3), 41(1), 42(3), 46(5) – which formula is the subject of further provisions at ss 29 and 68 in respect of the language and manner of service of such notices; and (d) “in such manner and at such time as he thinks fit, inform” (as in ss 47(1), (2) and (3), 49(ii)(A)).  She submitted that if written notification had been required for compliance with a s 18(1)(a) request, this could easily have been expressly stated, but it was not. Hence, the context of s 18(1)(a) and 19 is that if written notification is required by the Ordinance, that is expressly stated.  Accordingly, the context supports the natural and ordinary meaning of “informed” being attributed to that word in s 18(1)(a).  In further support of this, she referred us to Hong Kong Data Privacy Law by Berthold and Wacks, 2^nd ed, para 8.48; Data Protection Principles in the Personal Data (Privacy) Ordinance – from the Privacy Commissioner’s Perspective, 2006 and 2010 ed, para 10.23; PCPD’s Information Paper on Review of the Personal Data (Privacy) Ordinance, 2009, Proposal No 55.

28. I agree with all her submissions above.

29. I turn to Mr Kwok’s submission that as a data access request under s 18(1) is treated as a single request by virtue of s 18(2) and (3), the only permissible way to comply with a s 18(1)(a) data access request must be in writing, “given that s 19 stipulates that a data request must be complied with in writing”.

30. Mr Kwok referred us to s 18(2) which provides that a data access request under both s 18(1)(a) and (b) shall be treated as a single request, and s 18(3) which provides that a data request under s 18(1)(a) may, in the absence of evidence to the contrary, be treated as a request under both s 18(1)(a) and (b).  He submitted that as the DARs in the present case sought “police data regarding offences or convictions” and the Police were requested to supply the date and nature of the offence if they hold any criminal records for the complainant and his family, the DARs were requests made under both s 18(1)(a) and (b) and should be treated as a single request by virtue of s 18(2), and possibly s 18(3).  I have no problem with that.

31. Next, Mr Kwok submitted that as both s 18(2) and (3) stipulate “the provisions of this Ordinance shall be construed accordingly”, that would include the provisions in s 19.  He relied on s 19(2) and argued that the present case would fall within that provision as the data user “is unable to comply” with the single request in that the Police do not hold any relevant criminal record.  But that is to misread s 19(2).  It is clear from the wording of s 19(2)(b) that this provision covers the situation where the data user is unable to comply with the data access request within the specified period of 40 days in s 19(1), namely, temporarily, as s 19(2)(b) stipulates that “as soon as practicable after the expiration of that period”, the data user shall comply or fully comply with the request.  Besides, the Police were not unable to comply with the single request.  They would have complied with it by informing the complainant that they do not hold any relevant criminal record.

32. I fail to see the basis on which Mr Kwok derived the premise that s 19 stipulates that a data request must be complied with in writing.  I do not agree with his contention.  As has been analysed earlier, s 19(2), (3) and (4) contain provisions laying down the requirement of written notification in specific situations.  These provisions do not stipulate that a data access request must be complied with in writing, nor do they apply to the situation where the data user does not hold the personal data being the subject of the request. 

The purpose and public policy

33. Miss Ismail took us first to the Ordinance.  S 4 provides that a data user shall not do an act that contravenes a data protection principle unless required or permitted by the Ordinance.  Data Protection Principle 6, which is concerned with access to personal data, provides that a data subject shall be entitled to ascertain whether a data user holds personal data of which he is the data subject.  Miss Ismail made the valid point that nothing in Principle 6 indicates that such information should be provided in writing, as opposed to simply being provided.

34. As stated in the explanatory memorandum to the Personal Data (Privacy) Bill 1995, the bill gives effect to the majority of the recommendations contained in the report of the Law Reform Commission on Reform of the Law Relating to the Protection of Personal Data published in 1994.  Chapter 14 of the report deals with data subjects’ rights of access and correction.  As pointed out by Miss Ismail, no recommendation was made as to the form of the information as to whether the data user held relevant data.  The Commission had regard to the Rehabilitation of Offenders Ordinance, Cap 297 in para 3.15 of the report, and the “forced access” issue, in the context of whether it should be a criminal offence to require a data subject to exercise his data access rights to reveal his criminal record (paras 14.40 to 14.42).

35. Miss Ismail submitted there is public policy interest involved in maintaining the natural and ordinary meaning of the statutory provisions.  The Police have provided details of their concerns relating to the provision of written confirmation of no criminal records in their submission to the Board in the 2^nd Appeal, which are similar to the concerns noted in paras 14.41 and 14.42 of the Law Reform Commission Report.  In summary, criminal conviction records are regarded as sensitive personal data to be released in very restrictive circumstances.  A written confirmation requirement might lead to an abuse of the data access request system by enabling employers to force prospective employees to prove they have no convictions.  Possible “forced data access” by employees would go against the spirit of the Rehabilitation of Offenders Ordinance, as well as the Ordinance, which is intended to protect rather than discriminate against persons with criminal convictions.  The consequence of “forced data access” would be to create an unemployable “underclass” unable to provide records of no convictions, with potential impact on social stability.  See also Hong Kong Data Privacy Law by Berthold and Wacks, paras12.47 to 12.51.

36. I agree these public interest concerns are powerful considerations.

37. There is also the principle against doubtful penalisation.  A contravention of s 19(1) without reasonable excuse is an offence under s 64(10). This is another reason why ss 18(1)(a) and 19(1) should not be construed so as to penalise a person for giving information orally, where it is not clearly stated by the legislature that the information must be in writing.  See PCPD’s Information Paper on Review of the Personal Data (Privacy) Ordinance, 2009, Proposal No 55 para 6.

38. I note that there is legislative amendment in the pipeline regarding s 19(1) in the Personal Data (Privacy) (Amendment) Bill 2011, the effect of which is to provide expressly for the manner of compliance with a data access request in writing and to permit the Police to inform the requestor orally they do not hold any record of criminal conviction of an individual. I have not relied on this in the construction of the existing statutory regime.  However, whilst the post-enactment development of the proposed amendment to s 19 of the Ordinance by clause 12 of that Bill is, of course, not relevant to the construction of s 19 of the Ordinance as it stands at present, the proposed amendment does clearly support the public policy concerns of the Police as reflected in paras 14.41 and 14.42 of the Law Reform Commission Report.

Conclusion and orders

39. For the above reasons, I have answered the question of law referred by the Board in the affirmative, that on the true construction of s 19(1) of the Ordinance, it is legally permissible for a data user, in compliance with s 18(1)(a), to inform the requestor verbally that the data user does not hold personal data of which the requestor is the subject.

40. There is no reason to depart from the usual rule that costs should follow the event and we have so ordered at the conclusion of the hearing.

Hon Fok JA:

41. I fully agree with the reasons for judgment of Kwan JA and there is nothing further I wish to add.

Hon Bharwaney J:

42. I agree with the judgment of Kwan JA.