Keywords: Privacy Commissioner, Data Privacy Law, Personal Data Privacy Ordinance, PDPO
This legal update is part of our series discussing the effects of the Personal Data (Privacy) Amendment Ordinance 2012 when it comes into force in Hong Kong.
One of the key changes is that the Privacy Commissioner will soon be conferred with the power to grant legal assistance to any aggrieved person who wishes to seek compensation from a wrongdoer.
So beware: the Privacy Commissioner will flex his muscles to help establish some new case law.
1. Current Position
Currently, under section 66 of the Personal Data (Privacy) Ordinance (PDPO), an aggrieved person may bring legal proceedings in the District Court against a wrongdoer to seek compensation for contravening the PDPO.
However, there is no precedent in Hong Kong indicating the criteria by which, or the extent of the generosity with which, the court may assess and award damages for this type of claim.
Given the legal costs involved in bringing court proceedings, claims of this nature are rare.
2. What's New?
2.1 Privacy Commissioner's power to grant legal assistance
The Amendment Ordinance will soon empower the Privacy Commissioner to provide various forms of legal assistance to a person who has a right to claim compensation for damage suffered as a result of the data user's contravention of the PDPO.
We understand that this part of the Amendment Ordinance will come into force in or around January 2013.
To help an aggrieved person decide whether to commence court proceedings, the Privacy Commissioner will produce new prescribed forms that the aggrieved person or the data user (e.g., an employer) may use in questioning and replying.
If the aggrieved person questions the data user, and the data user does not answer or is evasive in its reply, the District Court may draw an adverse inference from this.
2.2 What factors would the Privacy Commissioner consider?
An aggrieved person may apply for legal assistance to the Privacy Commissioner, who will consider whether:
- the case raises a question of principle; or
- it is unreasonable, having regard to the complexity of the case or the aggrieved person's position, to expect the aggrieved person to deal with the case unaided.
Based on his consideration of the above factors, the Privacy Commissioner may grant legal assistance if he thinks fit to do so.
2.3 What form of legal assistance may be granted?
The Privacy Commissioner may assist by:
- giving advice;
- arranging for advice or assistance to be given by a solicitor or barrister;
- arranging for representation by a solicitor or counsel in court, or in reaching a compromise; and
- giving any other form of assistance as he considers appropriate.
2.4 Can legal costs be recovered in these court proceedings?
Employers should be aware that unless the court proceedings are brought maliciously or frivolously, or there are special circumstances which warrant an award of costs, each party usually bears their own costs in any court proceedings brought under the PDPO.
3. Views of the Privacy Commissioner
With the power to grant legal assistance, the Privacy Commissioner will flex his muscles to help establish some new legal precedents. He will use this opportunity to enhance public awareness of privacy issues.
The Privacy Commissioner's Office has indicated that the Privacy Commissioner will likely refer to overseas cases (particularly to cases in Australia) to help establish the criteria and levels of generosity for assessing compensation.
4. Compensation Awards
As our tips to employers (and other data users), the following is a summary of some of the principles derived from data privacy cases in Australia for awarding compensation:
- Where a complaint is substantiated and loss is suffered, the privacy legislation contemplates some form of redress in the ordinary course;
- Awards of compensation should be restrained but not minimal;
- Aggravated damages may be awarded in appropriate cases;
- Compensation should be assessed having regard to the complainant's reaction, as opposed to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances;
- The court may seek assistance from decisions which interpret similar provisions in other legislation. For instance, awards for injury to feelings may be made with reference to discrimination and harassment cases.
- In Australia, the range of award would range from A$1,000 to A$25,000. For 'serious breach' of the privacy legislation, the amount of compensation would be A$8,000.
- Apologies could affect the amount of damages awarded. So apologies should be more than mere platitudes.
To minimize the risk of litigation, employers are well advised to review their existing systems and procedures in collecting and managing their employees' personal data.
Previously published on 27th September 2012.
Visit us at www.mayerbrownjsm.com
Mayer Brown is a global legal services organization comprising legal practices that are separate entities (the Mayer Brown Practices). The Mayer Brown Practices are: Mayer Brown LLP, a limited liability partnership established in the United States; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales; Mayer Brown JSM, a Hong Kong partnership, and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2012. The Mayer Brown Practices. All rights reserved.
This article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein. Please also read the JSM legal publications Disclaimer.
Specific Questions relating to this article should be addressed directly to the author.