X v. MELISSA MOWBRAY-D'ARBELA AND ANOTHER

DCCJ 3793/2016

[2018] HKDC 215

IN THE DISTRICT COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

CIVIL ACTION NO 3793 OF 2016

--------------------------

--------------------------

---------------------

DECISION

---------------------

1.  The plaintiff commenced this action for loss and damage caused to her by the breaches and contraventions of Data Protection Principles (“DPP”) 3 and 4 under the Personal Data (Privacy) Ordinance (“PDPO”) by Melissa Mowbray-D’Arbela (“D1”) and Pathfinders Limited (“D2”), as well as compensation under section 66 of PDPO. Before me are two summonses, one taken out by D1 on 13 October 2017 (“D1 Summons”) and the other taken out by D2 on 31 October 2017 (“D2 Summons”), both for striking out of the Statement of Claim and the dismissal of the claims of the plaintiff on the grounds that they are frivolous or vexatious and/or an abuse of the process of the court.

2.  The plaintiff first filed a complaint for breach of the PDPO against D2 to the Privacy Commissioner for Personal Data (“PCPD”) on 9 February 2015.  On 30 April 2015, the PCPD decided not to pursue the complaint against D2 under section 39(2)(d) of the PDPO. From the written decision issued by PCPD, it can be seen that the complaint against D2 was in relation to an alleged disclosure of personal data of the plaintiff in a prosecution bundle (“Prosecution Bundle”) and a summary of events (“Timeline of Events”) by D1 to the parents of the plaintiff.  D1 was the co-founder and a former director of D2 and the plaintiff alleged that D2 was vicariously liable for the actions of D1. 

3.  A complaint for breach of the PDPO against D1 was later filed by the plaintiff to the PCPD on 17 April 2015 in respect of, inter alia, the same alleged disclosure of personal data.  The PCPD decided likewise on 11 March 2016 in respect of this complaint against D1 for disclosure of the Prosecution Bundle and the Timeline of Events to the plaintiff’s parents. 

4.  The plaintiff appealed against both decisions to the Administrative Appeals Board (“Board”).  The two appeals were heard separately by differently constituted panels of the Board.  An oral hearing took place in public in both appeals and all parties made written and oral submissions to the Board.  Before any of the decisions of the Board was handed down, the plaintiff commenced this action.  The Writ and Statement of Claim (“SOC”) in this action was filed by the plaintiff on 1 August 2016.

5.  The decision of the Board in respect of the appeal against the decision of the PCPD relating to D2 (AAB No 17/2016) (“D2 Appeal”) was handed down on 17 October 2016 (“D2 Decision”).  The decision of the Board in respect of the appeal against the decision of the PCPD relating to D1 (AAB No. 18/2016) (“D1 Appeal”) was handed down on 21 February 2017 (“D1 Decision”).  Both D1 Appeal and D2 Appeal were dismissed.

6.  On 30 December 2016, the plaintiff filed an application to seek the leave of the Court of First Instance (“CFI”) to apply for judicial review in respect of the D2 Decision.  An oral hearing was held and the CFI refused the plaintiff’s application for leave. The plaintiff filed an appeal against the decision of the CFI out of time on 27 April 2017.  The Court of Appeal refused to grant an extension of time to file the appeal. 

Factual background

7.  The background of the case has been set out in greater detail in the D1 Decision and the D2 Decision, and the D1 Decision has been published on the website of the office of the PCPD. The factual background set forth below is mainly extracted from the two decisions.

8.  D2 is an approved charitable institution whose principal activity is providing assistance and support to distressed migrant women and their children born in Hong Kong, with a published Privacy Policy.  D1 was a co-founder and former director of D2.  The plaintiff, a single migrant mother of a young boy, was a client of D2. 

9.  In November 2010, the plaintiff was arrested for credit card fraud, but she was put on police bail or unconditionally released.  D2 was engaged to assist the plaintiff and her young son in March 2011 as a result of an incident involving her son.  The plaintiff signed an agreement with D2 relating to the use of her personal data on 17 March 2011.  That engagement by the plaintiff of D2 ended on 16 June 2011.

10.  In February 2013, the plaintiff was arrested again for credit card fraud.  The plaintiff was introduced to D1 and assistance was sought from D2 again.  D1 was assigned as the principal case officer for the plaintiff.  On 15 April 2013, the plaintiff signed a pro forma document entitled “Consent to Release or Obtain Personal Data” whereby, inter alia, the plaintiff consented to authorized representatives of D2 to release her personal data to, and/or obtain her personal data from, supporter of D2 as required by them or D2 on a need-to-know basis for the provision of the services of D2 to her and/or her child. 

11.  Assistance provided by D2 to the plaintiff included obtaining legal assistance in relation to the fraud charge, obtaining medical advice in relation to the mental health issues of the plaintiff, finding housing for the plaintiff and her son, helping with the son of the plaintiff, including giving advice on the son’s education.  According to D2, the plaintiff’s client relationship with it ended in July 2013, but D1 continued supporting and assisting the plaintiff in her personal capacity, to the extent of allowing the plaintiff and her son to reside in her home with her family and caring for her son while she was admitted to a hospital for a few days in July 2013.

12.  On 25 March 2014, the plaintiff supplied to D1 the Prosecution Bundle in relation to the fraud charge, via email and a USB flash drive.  There is an email of 31 March 2014 from D1 to a group of people, including the plaintiff, setting out D1’s views on the Prosecution Bundle and on further evidence to be gathered that could potentially assist the plaintiff in defending the fraud charge.

13.  By 12 April 2014 however, if not earlier, things turned sour between the plaintiff and D1.  An email of that date from D1 to the plaintiff shows that D1 was accusing the plaintiff of having indeed committed the fraud in question.  In a series of emails between the plaintiff and D1 from 12 to 14 April 2014, D1 mentioned twice that she had spoken to the parents of the plaintiff to help them understand the situation. No objection was raised by the plaintiff in her reply emails.

14.  D1 continued to assist the plaintiff in so far as ensuring the welfare and best interests of her son were catered for.  On 17 April 2014, the plaintiff signed a Deed of Appointment of Guardians (“Deed of Appointment”) at the office of Messrs Oldham, Li & Nie (“OLN”) to appoint her parents as the guardians of her son.  The parents signed on the Deed of Appointment on the same day.  It is not known who gave instructions to OLN that day. 

15.  Clause 1(c) of the Recitals of the Deed of Appointment stated that the plaintiff was desirous of her son being placed in the care of her parents and taken to their home in the United Kingdom where he should live and attend school, until such time as the plaintiff was in a position to provide a secure and stable home and take care of her son herself.  The parents of the plaintiff thereafter left Hong Kong for the United Kingdom with her son.

16.  In June 2014, the plaintiff pleaded guilty to and was convicted of the criminal charges brought against her in the District Court.  She was sentenced to a 12-month imprisonment suspended for a period of 24 months.  In July 2014, the plaintiff took out an action against her parents in the High Court (Family Division) in London for custody of her son (“London Action”). 

17.  In a series of emails on 1 August 2014, the father of the plaintiff (“Mr D”) told D1 that he and his wife had been accused by the plaintiff of abducting her son.  Mr D sought information and evidence from D1 that could be used to rebut such allegation, to show that it would be unsafe for the plaintiff’s son to return to Hong Kong with the plaintiff, and to contest the London Action generally.  According to the plaintiff, the London Action was made on the basis that her parents had wrongfully retained her son in the United Kingdom, and she never accused them of child abduction in the London Action.

18.  In an undated email, but appearing to be in response to the 1August 2014 emails from Mr D, D1 suggested, inter alia, showing the Prosecution Bundle to Mr D’s lawyer, further stating that “[the plaintiff] permitted [D1] to send it to [Mr D] and [Mr D has] no obligation to keep it confidential”.  There is another email dated 2 August 2014 from D1 to Mr D, in which D1 mentioned that she had sent the “full police evidence files” to Mr D a long time ago.

19.  In another email dated 2 August 2014 from D1 to Mr D, D1 said, inter alia –

“[the plaintiff] gave me permission in my personal capacity to share the police evidence and anything else with you, to give you the full story. She has not since rescinded that permission. She has not asked you to keep this information confidential … I urge you to review the previous emails I have sent you outlining why [the plaintiff] is incapable of caring for [her son] from a purely financial perspective…”

In that email, D1 attached a timeline of key events relating to the plaintiff, that is the Timeline of Events, that D1 suggested using to contest the London Action.  The Prosecution Bundle was not attached to any of these emails.

20.  There is no dispute that D1 did send the Timeline of Events to the parents of the plaintiff and they adduced it in the London Action.  It is not clear though whether the Prosecution Bundle was adduced in the London Action.

Pleadings of the plaintiff

21.  The pleas of the plaintiff in the SOC on the breach of PDPO and the claims for damages are reproduced below:-

“12.   On or about 2^nd August 2014 Melissa deliberately and knowingly disclosed personal data related to the plaintiff that was collected in her capacity as Pathfinders representative, to the Plaintiff’s parents in breach of Data Protection Principle 3 (DPP3) of Cap. 486 Personal Data (Privacy) Ordinance (“PDPO”).

…

14.   The Plaintiff’s personal data disclosed by Melissa included details of criminal matters, immigration data, medical data and financial data from 10 July 2010 to 16 April 2014.  The personal data was supplemented by subjective notes added by Melissa including the source of the information (including Pathfinders records), and how the personal data could be interpreted.  Such interpretations were inaccurate and injurious to the Plaintiff.

15.   The essential elements for vicarious liability apply to Pathfinders as follows: i) Melissa was a director and officer of Pathfinders, ii) Melissa committed a tort (Breach of DPP3), and iii) the management, control and disclosure of the Plaintiff’s personal data was directly related to Melissa’s position as a director of Pathfinders, so accordingly the tort was committed in the course of employment.  Therefore, Pathfinders is vicariously liable for the breach of DPP3 by Melissa.

16.   As Pathfinders was the ‘data user’ under the meaning given in the Personal Data Privacy Ordinance, of the Plaintiff’s personal data, Pathfinders failed to take all practicable steps to protect the Plaintiff’s personal data against unauthorized access in breach of Data Protection Principle 4 (DPP4).

17.   Such breaches and contravention of the DPP3 and DPP4 by Melissa and Pathfinders caused loss and damage to the Plaintiff.  The disclosure of the Plaintiff’s personal data including the inaccurate and injurious interpretations provided by Melissa was used by the Plaintiff’s parents as a basis for refusing to return the Plaintiff’s son to the Plaintiff.

18.   As a result of the unauthorized disclosure of the Plaintiff’s personal data to the Plaintiff’s parents, the Plaintiff was forced to make an extended stay in the UK thereby incurring significant costs and expenses.”

The full text of the DPP that are referred to by the parties can be found in the Appendix to this judgment.

22.  The reliefs asked for in the prayer of the SOC are:-

(1)   Damages being the costs and expenses caused by the extended stay in the UK as detailed in paragraph 19 of the SOC, which cover loss of income, additional hotel costs, travelling expenses, wasted school fees and lost rental deposit;

(2)   Compensation for breach of DPP3 as specified in section 66 of the PDPO;

(3)   Compensation for breach of DPP4 as specified in section 66 of the PDPO;

(4)   Interest;

(5)   Costs; and

(6)   Further or other relief.

23.  In addition to the SOC, the plaintiff has on 4 August 2017 filed a Response to the Request of D1 for Further and Better Particulars of the SOC (“FBP”).  In the FBP, the plaintiff has mainly set out arguments in support of her case.  In doing so, she has also expanded on her claims in the SOC.  For example, there is mention of the liability of the Data Transferor and Data User under section 64 of PDPO, the delay of D2 in complying with a data access request of the plaintiff, and the failure of the defendants to adhere to section 33 of PDPO although the section has not come into effect yet. 

The case of the defendants

24.  In the affirmation filed on behalf of the 1^st defendant, the events leading to the hearing of the D1 Appeal and the handing down of the D1 Decision were averred to.  It is D1’s case that the complaint of the plaintiff to the PCPD was based on the same facts as those pleaded in the present case, the D1 Decision being a judicial decision of a final character made by a competent tribunal between the same parties, and the same question of whether D1 had breached the PDPO by releasing personal data of the plaintiff to her parents being decided by the Board against the plaintiff mean that, on the principle of res judicata, it is an abuse of process for the plaintiff to seek to re-litigate the matters.  D1 has also referred to the complaint filed against D2 by the plaintiff to PCPD in respect of the same incidents of disclosure of her personal data to her parents and the appeal of the decision of PCPD to the Board. 

25.  The affirmation filed by D2 sets out a similar background of the complaints by the plaintiff to the PCPD, the two appeals to the Board and the decisions of the Board.  D2 also refers to the agreement of the PCPD to the disclosure of the D2 Decision in the present action and the comments of the legal counsel of PCPD that the subject matter of the complaint lodged with the PCPD being common to the D2 Appeal and the present action, as well as the view of the Board that the present action is a mirror image of the D2 Appeal. 

26.  As in the case with D1, that the factual basis of the plaintiff’s claims had already been finally determined by way of a rehearing of the merits by the Board, a judicial tribunal with jurisdiction over the parties also forms the ground for the striking out application of D2.  In addition, D2 referred to the failure of the plaintiff to provide information on the judicial review application that she had taken out and the objection of the plaintiff to the application of D2 for the approval of the Board to the disclosure of the D2 Decision.

The plaintiff’s case

27.  The plaintiff filed affirmations for opposing the D1 Summons and the D2 Summons, the contents of which are mainly arguments.  She kept repeating such arguments in her skeletal submissions.  Although I have considered all the arguments in full, I will only set out in this decision those arguments that have to be addressed for disposing of the matter.  Below is a brief account of such arguments and more details can be found in the discussions below when I deal with them one by one.  

28.  It is the plaintiff’s case that the Board is an administrative body and not part of the Judiciary, its decisions are not judicial in nature, not all of the panel members are legally trained, and there is no statutory appeal from its decisions.  The plaintiff stressed that the review of the Board is narrow, it only assessed and reviewed the administrative function of the PCDC, but it did not review the merits of the case.  The review process of the Board is, in the view of the plaintiff, to assess whether the PCPD acted lawfully, but judicial merits were not at issue.

29.  In particular, the plaintiff asked me to note that the “review” by the Board was only a determination of whether the PCPD should have made a decision to investigate the matter fully. She drew my attention to section 21(3) of the PDPO which, she said, only empowers the Board to order the case be sent back to the PCPD for consideration of such matter as the Board may order.  As such, the decisions of the Board are only advisory in nature and not final decisions. 

30.  The plaintiff also challenged the applicability of the res judicata principle on the basis that the parties to the hearing of the Board are not the same as the present action.  As she put it, the appeal to the Board was between the plaintiff and the PCPD and not between the plaintiff and D1 or D2, and D1 and D2 were not required to attend the hearing of the Board.  The defendants were not considered as respondents before the Board, they were each an “interested party” only in the respective appeal.

31.  In respect of the way the proceedings before the Board was conducted, the plaintiff submitted that the Party Bound was not asked by the panel of the Board to speak or give evidence and the plaintiff was not permitted to cross examine the Party Bound.  It is her case that the Party Bound and their representatives were making untrue representations to the Board or giving opinion evidence before the Board, when the question should have been referred to the Court of Appeal.

32.  The failure of the Board to take into account new information revealed while D1 Appeal and D2 Appeal were ongoing is also a concern to the plaintiff.  She had made a data access request to D2 for the case notes kept by D2 in respect of the plaintiff which she said was not complied with by D2 within the statutory time limit.  However, when D2 eventually released the case notes, the Board refused to consider any documentation not made available to PCPD. 

33.  That the two separate panels of the Board had only incomplete evidence was, in the view of the plaintiff, partly to account for why they came to conflicting findings on the date when D1 came into possession of the Prosecution Bundle.  On the matter of the incompleteness of evidence, the plaintiff stressed that proper disclosure could take place in this action, when D1 and D2 would be required to submit all the emails sent by D1 and OLN would be required to disclose the letter of instructions in relation to the Deed of Appointment they prepared.

34.  Another matter relied on by the plaintiff is the lack of power of the Board to make an award for damages. She pointed out that the only financial award that the Board can make is one relating to costs under sections 21(1)(k) and 22 of the AABO.  Given that the plaintiff would have to litigate again to recover damages even if the decision of the Board had been in her favour, whether with the assistance of the PCPD or not, she argued that the Board was not a competent court that had jurisdiction over the parties and the subject matter. 

35.  Also not litigated in D1 Appeal and D2 Appeal are, in the opinion of the plaintiff, the issues relating to DPP2, DPP3, DPP4, DPP6, sections 18, 64 and 65 of the PDPO.  In the FBP and the affirmations and skeletal submissions of the plaintiff, other alleged breaches of the PDPO have indeed been raised.  There is also the mention of a declaration being sought for D1 to be injuncted from further use or disclosure of the personal data of the plaintiff.  Hence, the plaintiff submitted that the res judicata is not applicable.

36.  The plaintiff has referred to the fact that no costs order was made against her in D1 Appeal and D2 Appeal. That, in her view, shows that she has a good, arguable case and her claims are not frivolous or vexatious. 

37.  A further matter drawn to my attention is the fact that this action was commenced after the hearing of D2 Appeal by the Board, but before the hearing of D1 Appeal and before either the D1 Decision or the D2 Decision was handed down by the Board.

Res Judicata

38.  A definition of res judicata can be found in Spencer Bower and Hundley Res Judicata, 4^th edition (“SB&H”), at paragraph 1.01 –

“… a decision pronounced by a judicial or other tribunal with jurisdiction over the cause of action and the parties, which disposes once and for all of the fundamental matters decided, so that, except on appeal, they cannot be re-litigated between the person bound by the judgment.”

39.  Ms Chiu has also referred me to the policy reason behind the doctrine of res judicata and issue estoppel, as noted in the judgment of Lord Wilberforce in The Ampthill Peerage Case [1977] AC 547, 569 and quoted in paragraph 1.10 of SB&H:-

“English law, and it is safe to say, all comparable legal systems, place high in the category of essential principles that which requires that limits be placed on the right of citizens to … reopen disputes … Any determination of disputable fact may, the law recognizes be imperfect: the law aims at providing the best and safest solution compatible with human fallibility and having reached that solution it closes the book. The law knows, and we all know, that sometimes fresh material may be found, which might perhaps lead to a different result, but in the interests of peace, certainty and security, it prevents further inquiry. It is said that in doing this, the law is preferring justice to truth. That may be so: these values cannot always coincide. The law does its best to reduce the gap. But there are cases where the certainty of justice prevails over the possibility of truth … and these are cases where the law insists on finality. For a policy of closure to be compatible with justice, it must be attended with safeguards; so the law allows appeals [and]… allows judgments to be attacked on the ground of fraud …”

40.  On the requisite elements of issue estoppel, paragraph 1.02 of SB&H provides some helpful pointers:-

“A party setting up a res judicata as an estoppel against his opponent’s claim or defence, or as the foundation of his own, must establish its constituent elements, namely that:

(1) the decision … was judicial in the relevant sense;

(2) it was in fact pronounced;

(3) the tribunal had jurisdiction over the parties and the subject matter;

(4) the decision was –

(a) final;

(b) on the merits;

(5) it determined a question raised in the later litigation; and

(6) the parties are the same or their privies.”

Defendants were not a party to the respective appeals

41.  There are clear provisions under the Administrative Appeals Board Ordinance (“AABO”) on who are to be regarded as parties to the appeal.  The definition of “parties to the appeal” in section 2 of AABO is relevant and is reproduced below:-

“parties to the appeal (上訴當事人) means the appellant, the respondent and any other person who is bound by the decision appealed against;”

42.  D1 and D2 were named as a party bound by the decision appealed against in D1 Appeal and D2 Appeal respectively.  As such, they became a party to the appeal within the meaning of section 2 of the AABO.  D1 and D2 are therefore also bound by the respective decisions of the Board.

43.  In an appeal to the Board, the rights and duties of a party bound by the decision appealed against, albeit not the appellant or the respondent, are no different from those of the appellant or the respondent.  Such a party can seek further particulars, inspect documents, request the giving of evidence by particular persons, appear, be present and make representations at the hearing of the appeal under sections 12, 13, 14, 15 and 18 of the AABO, and also to be ordered to provide particulars and to allow inspection of documents under those statutory provisions.

44.  It is right for the plaintiff to say that D1 and D2 were not required to attend the hearing before the Board.  Section 18 of the AABO provides as follows:-

“The parties to an appeal may appear and be present at the hearing of the appeal and may make representations or be represented either by a barrister or a solicitor or, with the approval of the Secretary, by any other person authorized by any of the parties in writing. The respondent may be represented by a legal officer within the meaning of the Legal Officers Ordinance (Cap. 87).”

The use of the word “may” does not mandate the presence of a party bound by the decision, but that applies to all parties to an appeal, which would therefore include the plaintiff as the appellant and the PCPD as the respondent, although how the Board may proceed when an appellant fails to attend the hearing has been provided for specifically under section 20 of the AABO.  It should be noted too that the appellant, the respondent and the party bound all appeared in D1 Appeal and D2 Appeal.  

45.  Had the decisions of the Board been in favour of the plaintiff in D1 Appeal and/or D2 Appeal, D1 and/or D2 would have been bound by such decision(s) and they cannot, just as the plaintiff, re-open the issues already determined by the Board and have them re-litigated.  There is thus no truth in the argument of the plaintiff that the D1 and D2 were not party to D1 Appeal and D2 Appeal respectively and I reject it.

Decisions of the Board are not judicial in nature

46.  The defendants sought reliance on the following passage from SB&H (at paragraph 2.05):-

“Every domestic tribunal, including any arbitrator, or other person or body of persons invested with authority to hear and determine a dispute by consent of the parties, court order, or statute, is a ‘judicial tribunal’ for present purposes, and its awards and decisions conclusive unless set aside”

47.  There are also judicial observations that support this principle that res judicata is not restricted to decisions of the court.  In the case of The Administration of Papua and New Guinea v Daera Guba (1973) 130 CLR 353, the court stated (at page 453):-

“The doctrine of estoppel extends to the decision of any tribunal which has jurisdiction to decide finally a question arising between parties, even if it is not called a court, and its jurisdiction is derived from statute or from the submission of parties, and it only has temporary authority to decide a matter ad hoc…”

48.  It is apparent from the above passage that it matters not whether the Board is part of the Judiciary for the res judicata principle to apply.  The principle can apply where the tribunal is a court or not a court, it can be a body person established by statute or just a person consented to by the parties in question.  The important point is that it be invested with the authority to hear and determine a dispute of the parties.

49.  The establishment of the Board is provided for in section 2 of the AABO.  Section 2 reads as follows:-

“Administrative Appeals Board

(1) There shall be a board called the Administrative Appeals Board.

(2) The functions of the Board are to hear and determine any appeal duly made to the Board.

(3) For the purpose of hearing any appeal the members of the Board shall comprise—

(a) the Chairman or a Deputy Chairman who shall preside; and

(b) 2 of the persons from the panel referred to in section 6(2) as the Secretary may appoint for that purpose.”

50.  The Board is therefore a body established by statute.  The types of decisions that can be appealed to the Board are specified in section 3 of the AABO.  Section 3 provides as follows:-

“Application

This Ordinance applies to—

(a) the Ordinances mentioned in column 2 of the Schedule in relation to any decision of the description mentioned in column 3; and

(b) any other decision in respect of which an appeal lies to the Board.”

51.  A number of the decisions of the PCPD are set out in item 29 of the Schedule to the AABO, including a decision of the PCPD under section 39 of the PDPO to refuse to carry out or to terminate an investigation initiated by a complaint, the subject matter of the appeal under D1 Appeal and D2 Appeal.  The Board is therefore clearly vested with the authority to hear and determine a dispute between the parties, which include the respective defendant as the party bound, the PCPD as the respondent and the plaintiff as the appellant.  It has jurisdiction over the subject matter and also the parties. 

52.  That some of the members of the panel of the Board were not from the legal profession was also a reason why the plaintiff considers the decisions of the Board to be not judicially rendered.  It can be seen from the passages quoted above that there is no requirement that for res judicata to apply, the decision has to be made by person(s) with legal background.  This is thus a non-issue.

53.  Another point raised by the plaintiff on the competence of the Board as a judicial tribunal is the lack of a statutory way of appeal to an appellate court.  I am not sure how this argument can be taken seriously as I do not see the plaintiff to be suggesting that the Court of Final Appeal is not a judicial tribunal although there can be no appeal from the decisions of the Court of Final Appeal. 

54.  That there are avenues for the decisions of the Board to be challenged is also something the plaintiff is fully aware of.  The plaintiff has sought leave for judicial review of the D2 Decision, albeit not successful.  It is her own decision not to avail herself of the judicial review procedure in respect of the D1 Decision, but that does not affect the competence of the Board in adjudicating the issues before it in those two appeals.

55.  Another head of challenge of the plaintiff is the lack of power of the Board to award damages which to her, means that the Board is not a court of competent jurisdiction.  The claims under the SOC do include one for damages under section 66 of the PDPO, but what is of relevance here are the issues that had been determined in the decisions of the Board, not whether there are other new claims in the present action. The issues that had been adjudicated by the Board cannot, because of the res judicata principle, be re-litigated.

Conduct of the proceedings before the Board

56.  The plaintiff also takes issue with the manner in which the proceedings before the Board were conducted, which in her view, also shows that the proceedings before the Board are not judicial in nature.  It is her submission that unlike the court, there was no discovery procedure and witnesses were not called or not cross-examined, in particular D1 was not asked by the Board to speak or give evidence.  According to the plaintiff, hearsay evidence was allowed to be adduced which shows that the rules of evidence did not apply to the appeals before the Board.  She also said that the legal representatives were asked to express their views on law points.

57.  As noted in the above, there are specific provisions in the AABO relating to discovery.  A respondent can be required to furnish information under section 11 of the AABO, including the reasons for the decision to which the appeal relates, the policy, if any, relied upon by the respondent when its decision was made, the particulars of any evidence or other thing considered and that had been relied upon by the respondent, the findings on material questions of fact relating to the decision.  A party to the appeal can require, with the approval of the Chairman of the panel of the Board (“Chairman”), further particulars to be furnished by any of the other parties under section 12 of the AABO.  Inspection of documents can be carried out with the approval of the Chairman under section 13 of the AABO.  Claim of privilege against disclosure can be raised by a party to the appeal under section 14 of the AABO.

58.  The power of the Board under section 13 of the AABO deserves closer attention.  Section 13 reads as follows:

Inspection of documents

(1) Any of the parties to the appeal may, with the approval of the Chairman, at any time serve notice on any of the other parties to produce any document relating to the appeal for his inspection and to permit him to take copies thereof and such of the other parties shall, subject to section 14, within 14 days after the notice is served, or such longer period as the Chairman, on application, may allow in any particular case, so produce and permit.

(2) A notice served under this section shall have effect as if it were a lawful order, requirement or direction of the Chairman.

59.  The case notes that the plaintiff considers to be of importance to the determinations by the Board could have been ordered to be produced, upon the application of the plaintiff. No such application had been made and it is not open to the plaintiff now to say that they should have been considered by the Board.  The same goes for the letter of instructions to OLN and the emails of D1 that the plaintiff thinks should have formed, but did not so form, part of the evidence before the Board.  The discovery mechanism was there but not availed of by the plaintiff. She cannot now re-open the litigated issues on this basis.

60.  I also reiterate a part of the observations of Lord Wilberforce in The Ampthill Peerage Case quoted in paragraph 39 above which says: “The law knows, and we all know, that sometimes fresh material may be found, which might perhaps lead to a different result, but in the interests of peace, certainty and security, it prevents further inquiry.”  Revelations of fresh material is not a ground for re-opening a decided issue as otherwise there will be no end to litigation. 

61.  As for the nature of the evidence that can be considered, there is no general rule against exclusion of hearsay evidence even for proceedings in the courts[1].  The question of course remains as to what weight the court should afford to such evidence.  As for calling of witnesses, section 15 of the AABO allows a party to an appeal to request the Board to issue a notice in writing to any person requiring such person to appear before the Board to give evidence and to produce any document relating to the appeal that is in his possession or under his control.  There had been no application for any one from D2 to give evidence on the case notes, for D1 to give evidence on her emails, or from OLN to give evidence on the letter of instructions for preparing the Deed of Appointment.

62.  The powers of the Board under section 21(1)(b), (c), (d), (e) and (f) of the AABO, reproduced below, are also relevant:-

“(1) For the purposes of an appeal, the Board may –

…

(b) receive and consider any material, whether by way of oral evidence, written statements, documents or otherwise, whether or not such material would be admissible in evidence in civil or criminal proceedings;

(c) by notice in writing signed by the Secretary, require any person to attend before it at any hearing and to give evidence and produce documents;

(d) administer oaths and affirmations;

(e) examine on oath, affirmation or otherwise any person attending before it and require such person to answer all questions put by or with the consent of the Board;

(f) determine the manner in which the material referred to in paragraph (b) shall be received;”

63.  D1 was legally represented and her lawyer attended the hearing on her behalf.  Had the plaintiff applied to the Board for cross-examination and such application allowed, the Board can require D1 to attend before it under section 21(1)(c) and allow cross-examination of D1 by virtue of the power under section 21(1)(e).   

64.  Further, as can be seen from the powers of the Board under section 21(1)(b), it can receive any matter as evidence, even if such material would not have been admissible as evidence in civil or criminal proceedings.  The Board is also empowered under section 21(1)(f) to determine the manner in which such material is to be received. This would have applied to materials presented to the Board by D1 and D2 as the respective party bound as well as by the plaintiff as the appellant.  It is open to the members of the Board to consider the weight to be afforded to any such materials, just as a court would have to assess the weight to be given to a piece of hearsay evidence in the proceedings before it. 

65.  The situation of witnesses not being called or not cross-examined at D1 Appeal and D2 Appeal did not arise because of a want of the requisite power, but because no request had been made by the parties, including the plaintiff.  The plaintiff admitted to her lack of knowledge of such procedural rights in her skeletal submissions.  Her own ignorance or inexperience is however not a ground for allowing her to have another run of the matter.  

66.  On the matter of evidence, the plaintiff raised a point about the Board having taken into account the evidence given by the legal representatives of the D1 and D2.  As she put it, the opinions of the legal representatives were sought by the Board when that should be a question for the Court of Appeal.  The plaintiff also sought to rely on the cases of Hollington v Hewthorn [1943] KB 587 and Three Rivers District Council v Bank of England (No 3) [2003] 2 AC 1 in support of her submission that judicial findings are not admissible in subsequent proceedings.

67.  When faced with the determination of a question of law or fact, unless so empowered by the statutes[2], the decision-making body has to come to a conclusion on its own.  In so doing, the decision-making body can ask the legal representatives to address it on the point in question, but the decision has to be that of the body itself.  It cannot shirk from its duty to resolve the point.  The suggestion of the plaintiff that the Board should refer the question to the Court of Appeal is misconceived.

68.  The reliance of the plaintiff on the cases of Hollington v Hewthorn and Three Rivers District Council v Bank of England (No 3) is in my view misplaced.  Lord Hope of Craighead did point out in the Three Rivers case that the report of the Bingham inquiry would not be admissible at any trial in that case, but it was because the investigation conducted was a private and not a statutory inquiry, the inquiry was conducted behind closed doors, the claimants were not present nor were they represented, the investigator had no power to compel the attendance of witness or to require the production of documents, and there was no counsel to the inquiry. 

69.  As has been demonstrated in the discussions above, the position with the appeals before the Board was entirely different.  The jurisdiction of the Board was conferred by statute, the hearings of the Board were open to the public, the plaintiff, PCPD, D1 and D2 were present or represented, the Board had power to compel the attendance of witness and to require production of documents, and the legal representatives of the parties could provide counsel to the Board.

70.  In the case of Hollington v Hewthorn, a certificate of the conviction of the defendant in that case of driving without due care and attention was held to be not admissible in the later civil proceedings against him for negligence.  Such position can no longer be taken in Hong Kong in view of section 62 of the Evidence Ordinance. The relevant parts of section 62 are extracted below –

“Convictions as evidence in civil proceedings

(1) In any civil proceedings the fact that a person has been convicted of an offence by or before any court in Hong Kong shall, subject to subsection (3), be admissible in evidence for the purpose of proving, where to do so is relevant to any issue in those proceedings, that he committed that offence, whether he was so convicted upon a plea of guilty or otherwise and whether or not he is a party to the civil proceedings; but no conviction other than a subsisting one shall be admissible in evidence by virtue of this section.

(2) In any civil proceedings in which by virtue of this section a person is proved to have been convicted of an offence by or before any court in Hong Kong—

(a) he shall be taken to have committed that offence, unless the contrary is proved; and

(b) without prejudice to the reception of any other admissible evidence for the purpose of identifying the facts on which the conviction was based, the contents of any document which is admissible as evidence of the conviction, and the contents of the information, complaint, indictment or charge on which the person in question was convicted, shall be admissible in evidence for that purpose.”

71.  It should also be noted that with the application of res judicata or issue estoppel, it is not a matter of admitting the earlier decision as evidence for the purpose of deciding the issues in the subsequent set of proceedings.  Rather, the issues should not be re-opened or re-considered at all in the later proceedings.  The case authority is therefore of no help to the plaintiff.

Final determination of an issue on its merits

72.  The plaintiff places great emphasis on the consequences that would flow had the Board decided both D1 Appeal and D2 Appeal in her favour.  She was at pains to point out that the matters would have to be referred back to the PCPD to carry on the investigations only and the plaintiff would in any event have to commence action in court to sue for damages, whether with the financial assistance of the PCPD or on her own resources. 

73.  This is so because, as the plaintiff submitted, of the provisions of section 21(3) of the AABO.  Section 21(3) of the AABO reads as follows:-

“(3) The Board, on the determination of any appeal, may order that the case being the subject of the appeal as so determined be sent back to the respondent for the consideration by the respondent of such matter as the Board may order.”

As the plaintiff sees it, there can be no application of issue estoppel as D1 and D2 would have been at liberty to defend the eventual court action, even if the Board had found that the PCPD should continue with the investigation of the complaints filed by the plaintiff. 

74.  On the meaning of finality in terms of the application of the res judicata principle, paragraph 5.02 of SB&H provides some helpful insight:-

“5.02 … The decision must then finally determine the defendant’s liability leaving nothing to be judicially determined to fix the amount recoverable and render the judgment effective and capable of execution…”

75.  I accept that the plaintiff would have to sue separately for damages had the Board decided against the two defendants in D1 Appeal and D2 Appeal.  However, as noted above, the res judicata principle would then be available to the plaintiff in terms of the issues that have already been finally determined by the Board.  Thus, had the Board found that D1 was in breach of DPP3 and D2 was vicariously liable for such breach, D1 and D2 would have been able to put in a defence in terms of the quantum of damages payable to the plaintiff only, but they would have been similarly bound by the findings of the Board on liability that had been conclusively determined and they would not have been able to re-open them.

76.  That the nature of an appeal to the Board is a rehearing on the merits can also not be disputed.  This has been confirmed by the Court of Appeal on more than one occasion, including the decision on the application of the plaintiff for extension of time to appeal against the decision of the CFI in refusing to grant leave to her for judicial review of the D2 Decision, as noted in paragraph 33 of the judgment extracted below:-

“33. In contrast to judicial review proceedings, the appeal to the AAB is truly appellate and a rehearing on the merits …”

It is not therefore, as submitted by the plaintiff, that the merits of the issues before the Board had not been considered.

77.  I still have to consider the question, as framed in the case of William Henry Cowie v The Attorney General (unreported, 2 September 1998, Supreme Court of Hong Kong), of whether “the judicial decision was or involved, a determination of the same question as that sought to be controverted in the litigation in which the estoppel is raised”.  In terms of the issues before the Board, they have been clearly identified in paragraph 34 of the decision of the Board in D2 Appeal and in paragraph 77 of the decision of the Board in D1 Appeal.  They are set out below –

“Issues in relation to D2 Appeal:

(1) Whether there is prima facie evidence that [D2] at the material time was a data user as defined under the [PDPO];

(2) Whether there is prima facie evidence that [D2] was liable for [D1’s] act of disclosing the Prosecution Bundle and the [Timeline] of Events to the Appellant’s parent in the 2/8/2014 Email.

Issues in relation to D1 Appeal:

(1) Did the Person Bound disclose the Prosecution Bundle and the Timeline of Events (both of which contain the Appellant’s personal data) to Mr. & Mrs. D?

(2) If there was disclosure, was the disclosure for a new purpose?

(3) If the disclosure was for a new purpose, did the Appellant give prescribed consent to such disclosure?

(4) If no consent was given, are there any exceptions that exempt the applicability of DPP3?”

78.  In answering issue (1) in D2 Appeal, the Board decided that D2 was not a data user within the meaning of the PDPO.  As for issue (2) in D2 Appeal, the Board found that D2 did not collect or possess the Prosecution Bundle at any stage and that D1 disclosed the Prosecution Bundle and the Timeline of Events to the plaintiff’s parents in her personal capacity.

79.  In D1 Appeal, the Board found, in respect of issue (1), that there was disclosure of the Prosecution Bundle and the Timeline of Events by D1 to the parents of the plaintiff.  As regards issue (2) in this appeal, the Bound found the disclosure to have been done in the name of safeguarding the welfare of the plaintiff’s son and as such was done within the scope of the original purpose for which the personal data were collected.  With issue (3) in D1 Appeal, the finding of the Board is that there was no prescribed consent to the disclosure.  The Board found, in relation to issue (4) in this appeal, that the exemption under section 58(1)(d) of the PDPO was applicable to relieve D1 of any potential liability under the PDPO.

80.  In arriving at the abovementioned conclusions, the Board had actually made a number of other findings.  For example, the Board found that D1 was not an employee of D2.  It also found that the exemption under section 58(1)(d) of the PDPO is engaged not only where there has been unlawful or seriously improper conduct on the part of a data subject, but also where a party seeks to defend an allegation of unlawful or seriously improper conduct.  A great number of such other findings have been set out in the skeleton submissions of D2.  I do not see the need to set them all out here, since suffice it to say that to decide on the claims set out in the SOC, this court will have to determine the same issues as identified by the Board.  Both the factual and legal issues determined by the Board are identical to the factual and legal issues in the present case.  The question as posed in paragraph 77 above must therefore be answered in the affirmative.

81.  At various parts of the affirmations filed by the plaintiff, there are indications that the plaintiff is well aware that at least some of the issues in the present action are the same as those before the Board.  In her affirmation filed on 14 November 2017, the plaintiff stated at page 28 that

“Mr Douglas is attempting to deceive the Court as he is well aware that DPP3 only was considered by the AAB18/2016 who refused to consider DPP4 as the PCPD had not been asked to consider it”

and at page 41 (also at page 36 of the plaintiff’s affirmation filed on 8 December 2017) she averred that

“The issue which was decided by both the PCPD and the AAB of 17/201[6] and 18/2016 firmly placed the 1^st Respondent as having released the Personal Data without permission or consent. The question for the AAB18/2016 was whether there was a legal justification in doing so. The question for the Court remains the same.”

The above passages show that the plaintiff knows the Board had decided whether there was a breach of DPP3 by D1 and whether there was a legal justification in the disclosure of the personal data; that is, Issues (1) and (4) in D1 Appeal.

82.  The plaintiff has argued in some detail why the findings of the Board are, in her view, incorrect.  It can be seen from the definition of res judicata in SB&H quoted above that the correctness of the earlier decision is not part of the equation in the application of the principle.  Also, as had been explained in the passage quoted above from The Ampthill Peerage Case, the law does recognize the imperfect nature of any determination of disputable fact, but it prefers justice, in the form of certainty and security of closing the book, to truth. Hence, correctness of the earlier decision is not relevant.  It will therefore serve no useful purpose to go through those arguments of the plaintiff on the errors of the decisions of the Board as perceived by her.

83.  There is also no truth in the submission of the plaintiff that the Board was only carrying out a review of the administrative process of the PCPD, that it was concerned only with whether the PCPD had acted fairly in declining to investigate the complaints of the plaintiff further.  The D1 Decision and the D2 Decision clearly show that the Board did determine the above-listed issues and made findings on them.  Although the decisions of the Board can be challenged by way of judicial review, the findings were until so challenged successfully, conclusive and thus final.

84.  One other matter which seems to be of grave concern to the plaintiff is what she described as conflicting decisions of the separate panels constituting the Board in the two appeals. The conflicting finding relates to the time when the Prosecution Bundle came into the hands of D1.  In the D2 Decision, when setting out the background of the case, the Board mentioned that in March 2014 the Prosecution Bundle for the trial of the plaintiff in the District Court was received.  Then in setting out their reasons, the Board referred to the Prosecution Bundle falling in to the hands of D1 in August 2014.  In the D1 Decision, the supply of the Prosecution Bundle by the plaintiff to D1 was recorded to have happened in March 2014, as well as the acceptance of this by D1 and the plaintiff.

85.  As in the case with the other alleged errors in the decisions of the Board, the perceived conflict, even if it amounts to an error, does not affect the application of the res judicata principle.  Furthermore, the respective panels of the Board were only concerned with the question of whether D1 did in fact have access to the Prosecution Bundle before the disclosure of the personal data of the plaintiff to her parents occurred, a prerequisite before there could be any finding of disclosure.  The difference in the dates, both being prior to the disclosure complained of, has no practical effect on the findings of the Board on the issues listed above.

New claims

86.  The claim for damages under section 66 of the PDPO is indeed a new matter not covered by the D1 Decision and the D2 Decision.  However, whether there was a breach of the DPP is an underlying issue and a claim for damages can only be further processed if the issues on liability determined by the Board had been in favour of the plaintiff.  With such issues being the same as those before the court in the present case, they cannot be re-opened and there cannot be any award of damages.

87.  The plaintiff has made allegations of breaches of other DPP in her affirmations and in her submissions that have not pleaded in the SOC, including breach of DPP4 by D1 and breach of DPP2 and DPP6 by D1 and D2.  The plaintiff also complains that sections 18 and 64 of the PDPO had not been considered by the PCPD or the Board, while section 65 of the PDPO was not given appropriate consideration.  The text of these sections can be found in the Appendix hereto.  Another thing now raised by the plaintiff but which is not pleaded in the SOC is the request for a declaration that D1 is injuncted against using the personal data of the plaintiff for disclosure to third parties in any capacity. 

88.  The issues before the Board evolved mainly around breach of DPP3 by D1 and D2.  I should point out though that in respect of the alleged breach DPP4 by D2, the matter had already been considered by the Board in D2 Appeal as well.  Although not strictly required in light of their finding on the aforesaid issues, the Board did deal with it and they found, in paragraph 56 of the D2 Decision, against the plaintiff on the ground that their reasoning on the alleged breach of DPP3 by D2 equally applies to the allegation relating to DPP4. 

89.  Section 65 of the PDPO had also been duly considered by the Board.  That was the basis upon which the plaintiff claims D2 should be liable for the disclosure by D1.  The provisions of section 65(1), (2) and (3) were set out in full in the D2 Decision.  The Board took into account the absence of any service agreement entered into between D1 and D2.  It also found that there was no evidence that D1 had the express or implied authority of D2 to disclose the personal data of the plaintiff.  I do not therefore accept that there had not been appropriate consideration of section 65 of the PDPO.

90.  As for the other alleged breaches, they have not been pleaded in the SOC.  The claims of the plaintiff as set forth in the SOC have been set out in paragraph 21.  The breach of DPP3 by D1 and the breach of DPP3 and DPP4 by D2 have been pleaded, but there is no mention of any breach of DPP2 or DPP6, or of section 18 or 26 of the PDPO by any of the defendants in the SOC.  In the usual case, particulars served separately become part of the pleadings.  However, as noted in paragraph 18/12/1 of Hong Kong Civil Procedure 2018[3], it is not the function of particulars to take the place of necessary averments in the pleading nor to state the material facts omitted.  That being the case, I will not regard the additional matters in the FBP as part of the plaintiff’s pleading.

91.  Nevertheless, even if the additional alleged breaches had been pleaded in the SOC or the additional particulars set forth in the FBP were to be regarded as part of the plaintiff’s pleading, issue estoppel will still bar the plaintiff from pursuing them since the points now sought to be litigated could have been litigated in the earlier proceedings.  As pointed out in paragraph 18/19/10 of Hong Kong Civil Procedure 2018 –  

“It may be an abuse of procedure to litigate matters which have, or could have, been decided in earlier proceedings. The basic rule is that, where a matter becomes the subject matter of adjudication, the court requires the parties to put forward their whole case and will not (except under special circumstances) permit them later to reopen matter which might have been brought forward as part of already concluded litigation…”

92.  Judicial statements in support of this principle can be found in the case of Ho Kin Man v Commissioner of Police [2013] 1 HKC 13, where it was said that –

“…It cannot be an answer to the proposition that if a point is open and should have been taken, to say that neither I nor my solicitor appreciated that the point was open, and we therefore acted under a mistake…That raising the point now constitutes an abuse of process is plain beyond argument.”

93.  With the various powers of the Board mentioned in the discussions above, including the power to order discovery and to order examination of witnesses, all these new claims could and should have been raised before the Board.  Adopting the words of the Ho Kin Man case, raising these points now thus constitutes an abuse of process.

No costs awarded against the plaintiff by the Board

94.  On the plaintiff’s allegation that no costs order was made against her in D1 Appeal and D2 Appeal, first of all, it can be seen from the decision of D1 Appeal that no order as to costs was made because no application for costs was made.  More importantly, even if the plaintiff did have a good, arguable case in terms of merits when she appealed to the Board and even when she commenced the present action, her claims in the SOC can become vexatious or frivolous if her case has become obviously unsustainable or there is no longer any prospect of success because of the res judicata principle.  It should also be borne in mind that issue estoppel did not apply to the two appeals before the Board and hence the opinions of the Board on whether those appeals were vexatious or frivolous cannot assist the plaintiff.

Present action commenced before decision of Board

95.  At the time the writ in this action was issued, neither the D1 Decision nor the D2 Decision had been handed down yet.  However, the fact is that each of the defendants has to face two sets of proceedings which involve the determination of the same issues.  There has not been a stay of one set of the proceedings.  As and when the outcome of the determinations by the Board has become known, it would be an abuse for the plaintiff to continue with the second set of proceedings and to have a second go on the same issues.

Pronunciation of the decisions

96.  The plaintiff has made no suggestion that the requirement of pronunciation of the decision has not been met in the present case.  For the sake of completeness, I find D1 and D2 to have demonstrated the pronunciation of the D1 Decision and the D2 Decision.  These decisions of the Board had been issued to the parties.  A copy of each of the two decisions have been certified by the Secretary of the Board and as such, it is admissible in any proceedings as evidence of the decisions of the Board by virtue of section 25(4) of the AABO. 

Amendment of the SOC

97.  In an application for striking out the pleading of a party, the court has the power to allow amendment of the pleading[4].  Such a course of action is however only appropriate where the defect in the pleading can be rectified by amendment.  It would not be so where the amendments would be far-reaching and so radical as to amount to a totally new pleading which would probably provoke a fresh application to strike out.

98.  I do not see any use in allowing the plaintiff to amend her pleadings.  The additional factual background set forth in the FBP, the affirmations and skeletal submissions of the plaintiff relate to claims that the plaintiff could have included in the appeals before the Board, and so would still be susceptible to being struck out on ground of issue estoppel.  It would thus only be a futile effort.

Conclusion

99.  I bear in mind the following statements of Ma CJ in the case of Ko Hon Yue v Chiu Pik Yuk (2012) 15 HKCFAR 72 on the res judicata doctrine:

“For present purposes, it is sufficient just to refer to the following facets of the doctrine:

(1) The starting point is to recognize the doctrine is founded on an abuse of process…

(2)…

(3) It must therefore be essential when striking out a claim on this basis (and thus preventing a litigation of that claim) that an abuse is found to exist in seeking to raise in subsequent proceedings claims or issues which could and should have been raised in earlier proceedings. This abuse will usually take the form of the other party being “vexed” (or in some cases, the terms “oppressed”, “unjustly harassed” or “unjustly hounded” are used) by the subsequent set of proceedings…

(4) …With the procedural reforms introduced by the Civil Justice Reform in 2009, the courts in Hong Kong must now, when exercising their procedural powers, increasingly bear in mind not just the parties before them in any particular litigation but also the position of other litigants in the court process. RSC O.1A r.1(f) states as one of the underlying objectives of the court’s procedural powers under the Rules to be “to ensure that the resources of the court are distributed fairly”.

(5) …in considering this type of abuse, the court is required to assess a number of factors and balance competing interest…”

100.  Based on the discussions above, I am satisfied that all the requisite elements of res judicata have been established.  The plaintiff has had the opportunity to ventilate her grievances against D1 and D2 with the hearing of the D1 Appeal and D2 Appeal before the Board.  In the case of D2, the plaintiff has also tried to seek leave for judicial review.  Whilst I can understand her wish to have all details of her case unearthed and brought under scrutiny by the court, I have to balance this against the oppression that will be caused to D1 and D2 in being asked to go through another set of proceedings for determination of issues which either have been or should have been addressed in the appeals before the Board, as well as the need to ensure the fair distribution of the resources of the court. 

101.  Having balanced the competing interests in this case, I have come to the conclusion that the claims of the plaintiff ought to be struck out.  I therefore grant an order in terms of paragraph 1 of the D1 Summons and of paragraph 1 of the D2 Summons.

Costs

102.  Both defendants ask for costs, with D1 asking for costs on an indemnity basis.  At the time of the issue of the Writ in this action, D1 Appeal and D2 Appeal were still ongoing and none of the D1 Decision and the D2 Decision had been handed down yet. After the handing down of those decisions, the plaintiff attempted to take the matters further by seeking leave for judicial review of the D2 Decision.  When her application for leave was dismissed by CFI and her application for extension of time was refused by the Court of Appeal, the plaintiff still perseveres with the present action. 

103.  It is obvious that the plaintiff knows about the channel for challenging the decisions of the Board by way of judicial review.  Further, as noted in paragraph 81 above, the plaintiff has admitted to some of the issues considered by the Board being the same as the ones she is asking this court to determine.  I therefore find this to be a proper case for costs of D1 and D2 to be borne by the plaintiff on indemnity basis, all such costs to include any costs reserved and to be taxed if not agreed.  The above is a costs order nisi, which will become absolute if no application for variation is filed by way of Summons within 14 days from today. 

Appendix

Data Protection Principles

Principle 2—accuracy and duration of retention of personal data

(1)   All practicable steps shall be taken to ensure that—

(a)   personal data is accurate having regard to the purpose (including any directly related purpose) for which the personal data is or is to be used;

(b)   where there are reasonable grounds for believing that personal data is inaccurate having regard to the purpose (including any directly related purpose) for which the data is or is to be used—

   (Amended 18 of 2012 s 40)

(i)   the data is not used for that purpose unless and until those grounds cease to be applicable to the data, whether by the rectification of the data or otherwise; or

(ii)   the data is erased;

(a)   where it is practicable in all the circumstances of the case to know that—

 

(i)   personal data disclosed on or after the appointed day to a third party is materially inaccurate having regard to the purpose (including any directly related purpose) for which the data is or is to be used by the third party; and

(ii)   that data was inaccurate at the time of such disclosure, that the third party—

(A)   is informed that the data is inaccurate; and

(B)   is provided with such particulars as will enable the third party to rectify the data having regard to that purpose. 

(2)   All practicable steps must be taken to ensure that personal data is not kept longer than is necessary for the fulfillment of the purpose (including any directly related purpose) for which the data is or is to be used.

(3)   Without limiting subsection (2), if a data user engages a data processor, whether within or outside Hong Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other means to prevent any personal data transferred to the data processor from being kept longer than is necessary for processing of the data.

(4)   In subsection (3)—

   data processor(資料處理者) means a person who—

(a)   processes personal data on behalf of another person; and

(b)   does not process the data for any of the person’s own purposes.

Principle 3 — use of personal data

(1)   Personal data shall not, without the prescribed consent of the data subject, be used for a new purpose.
(Amended 18 of 2012 s. 40)

(2)   A relevant person in relation to a data subject may, on his or her behalf, give the prescribed consent required for using his or her personal data for a new purpose if—

(a)   the data subject is—

(i)   a minor;

(ii)   incapable of managing his or her own affairs; or

(iii)   mentally incapacitated within the meaning of section 2 of the Mental Health Ordinance (Cap 136);

(b)   the data subject is incapable of understanding the new purpose and deciding whether to give the prescribed consent; and

(c)   the relevant person has reasonable grounds for believing that the use of the data for the new purpose is clearly in the interest of the data subject.
(Added 18 of 2012 s 40)

(3)   A data user must not use the personal data of a data subject for a new purpose even if the prescribed consent for so using that data has been given under subsection (2) by a relevant person, unless the data user has reasonable grounds for believing that the use of that data for the new purpose is clearly in the interest of the data subject.

(4)   In this section—

new purpose (新目的), in relation to the use of personal data, means any purpose other than—

(a)   the purpose for which the data was to be used at the time of the collection of the data; or

(b)   a purpose directly related to the purpose referred to in paragraph (a).

Principle 4—security of personal data

(1)   All practicable steps shall be taken to ensure that personal data (including data in a form in which access to or processing of the data is not practicable) held by a data user are protected against unauthorized or accidental access, processing, erasure, loss or use having particular regard to—  

(a)   the kind of data and the harm that could result if any of those things should occur;

(b)   the physical location where the data is stored;
   (Amended 18 of 2012 s. 40)

(c)   any security measures incorporated (whether by automated means or otherwise) into any equipment in which the data is stored;
(Amended 18 of 2012 s. 40)

(d)   any measures taken for ensuring the integrity, prudence and competence of persons having access to the data; and

(e)   any measures taken for ensuring the secure transmission of the data.

(2)   Without limiting subsection (1), if a data user engages a data processor, whether within or outside Hong Kong, to process personal data on the data user’s behalf, the data user must adopt contractual or other means to prevent unauthorized or accidental access, processing, erasure, loss or use of the data transferred to the data processor for processing.
(Added 18 of 2012 s. 40)

(3)   In subsection (2)—
data processor (資料處理者) has the same meaning given by subsection (4) of data protection principle 2.

Principle 6—access to personal data

A data subject shall be entitled to—

(a)   ascertain whether a data user holds personal data of which he is the data subject;

(b)   request access to personal data—

(i)   within a reasonable time;

(ii)   at a fee, if any, that is not excessive;

(iii)   in a reasonable manner; and

(iv)   in a form that is intelligible;

(c)   be given reasons if a request referred to in paragraph (b) is refused;

(d)   object to a refusal referred to in paragraph (c);

(e)   request the correction of personal data;

(f)   be given reasons if a request referred to in paragraph (e) is refused; and

(g)   object to a refusal referred to in paragraph (f).

Personal Data (Privacy) Ordinance, Cap 486

18. Data access request

(1)   An individual, or a relevant person on behalf of an individual, may make a request—

(a)   to be informed by a data user whether the data user holds personal data of which the individual is the data subject;

(b)   if the data user holds such data, to be supplied by the data user with a copy of such data.

(2)   A data access request under both paragraphs of subsection (1) shall be treated as being a single request, and the provisions of this Ordinance shall be construed accordingly.

(3)   A data access request under paragraph (a) of subsection (1) may, in the absence of evidence to the contrary, be treated as being a data access request under both paragraphs of that subsection, and the provisions of this Ordinance (including subsection (2)) shall be construed accordingly.

(4)   A data user who, in relation to personal data—

(a)   does not hold the data; but

(b)   controls the use of the data in such a way as to prohibit the data user who does hold the data from complying (whether in whole or in part) with a data access request which relates to the data, shall be deemed to hold the data, and the provisions of this Ordinance (including this section) shall be construed accordingly.

(5)   A person commits an offence if the person, in a data access request, supplies any information which is false or misleading in a material particular for the purposes of having the data user—

(a)   inform the person whether the data user holds any personal data which is the subject of the request; and

(b)   if applicable, supply a copy of the data.

(6)   A person who commits an offence under subsection (5) is liable on conviction to a fine at level 3 and to imprisonment for 6 months.

64.  Offences for disclosing personal data obtained without consent from data users

(1)   A person commits an offence if the person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent, with an intent—

(a)   to obtain gain in money or other property, whether for the benefit of the person or another person; or

(b)   to cause loss in money or other property to the data subject.

(2)   A person commits an offence if—

(a)   the person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent; and

(b)   the disclosure causes psychological harm to the data subject.

(3)   A person who commits an offence under subsection (1) or (2) is liable on conviction to a fine of $1,000,000 and to imprisonment for 5 years.

(4)   In any proceedings for an offence under subsection (1) or (2), it is a defence for the person charged to prove that—

(a)   the person reasonably believed that the disclosure was necessary for the purpose of preventing or detecting crime;

(b)   the disclosure was required or authorized by or under any enactment, by any rule of law or by an order of a court;

(c)   the person reasonably believed that the data user had consented to the disclosure; or

(d)  the person—

(i)   disclosed the personal data for the purpose of a news activity as defined by section 61(3) or a directly related activity; and

(ii)   had reasonable grounds to believe that the publishing or broadcasting of the personal data was in the public interest.

65.  Liability of employers and principals

(1)   Any act done or practice engaged in by a person in the course of his employment shall be treated for the purposes of this Ordinance as done or engaged in by his employer as well as by him, whether or not it was done or engaged in with the employer’s knowledge or approval.

(2)   Any act done or practice engaged in by a person as agent for another person with the authority (whether express or implied, and whether precedent or subsequent) of that other person shall be treated for the purposes of this Ordinance as done or engaged in by that other person as well as by him.

(3)   In proceedings brought under this Ordinance against any person in respect of an act or practice alleged to have been done or engaged in, as the case may be, by an employee of his it shall be a defence for that person to prove that he took such steps as were practicable to prevent the employee from doing that act or engaging in that practice, or from doing or engaging in, in the course of his employment, acts or practices, as the case may be, of that description.

(4)   For the avoidance of doubt, it is hereby declared that this section shall not apply for the purposes of any criminal proceedings.