This synopsis provides a brief insight into the current state of law in Hong Kong relating to defamation, privacy and data protection.
Defamation
Sources of law
The defamation law is primarily found in the common law and complemented by legislation, mainly the Defamation Ordinance (Cap. 21) ("DO").
Elements of defamation
Defamation is the publication of a statement which injures the reputation of the person to whom it refers. Therefore, the plaintiff must establish that the statement: (1) is defamatory, (2) refers to the plaintiff and (3) is published.
Defamation in permanent form, such as written words, film or painting, is called libel, whereas defamation in transient form, such as spoken words or gestures, is called slander. Libel is actionable per se, but proof of some financial loss is required for an action for slander, subject to common law and statutory exceptions.
Whether the statement is defamatory depends on its meaning. Besides the natural and ordinary meaning of words, the law also recognises innuendo, i.e. secondary meanings given to words by the recipient of the communication with or without special knowledge.
Defences
Even if the plaintiff can establish all three elements, the defendant may raise the following defences:
Justification: There is no claim in defamation if the statement, or the "sting" of it, is true.
Honest comment: Traditionally known as "fair comment". Rebranded as "honest comment" by Lord Nicholls NPJ in Cheng v. Tse Wai Chun (2000) 3 HKCFAR 339, for the comment only needs to be honest; having an ulterior motive is not fatal. This is available to any statement of opinion on a matter of public interest that is based on facts being true or protected by privilege, indicates the facts on which the comment is made and is one which an honest person could have made.
Absolute privilege: Dictated by public policy, this is available in occasions where strict liability for defamation should be relaxed to enable one to express freely on important matters. It mainly applies to debates or proceedings in the legislature and things said in court or written in court documents or proof of evidence given by a witness. Fair and accurate reports of public court proceedings, published contemporaneously, are also covered, provided that no publication of blasphemous or indecent matter is involved.
Qualified privilege: This applies where the defendant has a duty or an interest to make the communication, the recipient has a corresponding duty or interest to receive the communication and the communication is made without malice. Common examples include an employer writing a reference about an employee and a crime report made to the police by a citizen.
Public interest: Commonly known as responsible journalism or Reynolds defence. It applies to statements made by the press (or indeed any person) on matters of public interest which are published in a responsible and fair manner.
Innocent dissemination: This applies to persons, not being the author, printer or main publisher, such as news vendors and postmen, who disseminated a defamatory statement but did not know and could not be reasonably expected to know the defamatory content, and such ignorance was not due to negligence. It extends to Internet Service Providers who promptly remove any offending content upon being notified.
Other statutory defences: The DO provides for a few other defences. A newspaper may avoid or mitigate liability by showing the libel was inserted without malice or gross negligence, publishing an apology and paying a sum of money into court by way of amends. Further, a defendant may offer to publish an apology and correction and, if not accepted by the plaintiff, rely on the defence of unintentional defamation.
Freedom of opinion/expression is guaranteed under the Basic Law, but this is subject to restrictions necessary for respect of the rights or reputation of others. In determining defamation cases, the Court seek to strike a balance between the two to maximise protection of these competing rights.
Remedies
The usual remedy is damages, but an injunction may also be available where there is a real possibility of the defendant repeating the defamatory statement.
General damages compensate the plaintiff for reputational damage. The court would consider all relevant factors when assessing the amount, including gravity of the defamation, prominence and extent of publication, credibility of the accuser, publication of an apology, etc. Where the plaintiff is an individual whose injury is aggravated by the case features, such as the defendant's malice and an unsupportable plea of justification, the court may award aggravated damages to further compensate the plaintiff. Exemplary damages are also available if the defamation is deliberately calculated by the defendant to gain profit.
The amount of damages is not capped, and is case-specific.
Criminal liability
It is an offence under the DO to maliciously publish any libel known to be false; there are also a few other libel related offences. However, such offences are rarely used in practice.
Limitation period
An action for defamation shall be commenced within six years from the date when the cause of action accrued, i.e. the date of defamation.
Jury
Any party to a defamation case in the High Court can apply for a jury trial, unless the court considers that the trial requires any prolonged examination of documents or accounts, or any scientific or local investigation which cannot conveniently be made with a jury.
Recent developments
The Court of Final Appeal clarified the scope of absolute and
qualified privilege recently:
In Jonathan Lu v Paul Chan Mo Po (2018) 21 HKCFAR 94, a
student's parents made defamatory statements alleging two
fellow students cheated in examination. Lord Reed NPJ held that the
critical question when considering the issue of malice in qualified
privilege is whether the dominant purpose for which the
communication was made was the same as the purpose for which the
privilege was accorded. Knowledge of the falsity of the
communication only goes to the purpose of the communication.
In Chang Wa Shan v Esther Chan Pui Kwan (2018) 21 HKCFAR 370, the plaintiff was a witness in another litigation and sued the defendant, who provided a document to be used for cross-examining him in that litigation. Lord Walker NPJ held that absolute privilege applies to witness statements, but not mere informers.
Privacy and Data Protection
Background
The Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") regulates the handling of personal data. The Office of the Privacy Commissioner for Personal Data ("PCPD") enforces the PDPO.
Personal data covers data relating directly or indirectly to a living individual, from which the identity of that individual can be directly or indirectly ascertained, in a form in which access to or processing is practicable. Anyone controlling the collection, holding, processing or use of personal data in or from Hong Kong ("data user") is subject to the PDPO.
Data processors
If a data user engages a data processor to process personal data on its behalf, it must, via contract or other methods, prevent (i) personal data transferred to its data processors from being kept longer than necessary; and (ii) any unauthorized or accidental access, processing, erasure, loss or use of the personal data. Data processors, however, are not regulated under the PDPO, and the data user is responsible for its data processors' actions.
Data protection principles
Amongst other things, data users must abide by the PDPO's data protection principles ("DPP"):
(a) DPP1: Only collect personal data by lawful and fair means, for a lawful purpose directly related to their functions or activities. Only adequate (but not excessive) personal data for such purpose should be collected. Data users must notify data subjects of certain information beforehand, such as the purpose for which the personal data will be used.
(b) DPP2: Ensure that the personal data held by them is accurate, up-to-date, and is not held for longer than necessary.
(c) DPP3: Only use personal data for the purpose for which the data was collected or a directly related purpose, unless the data subject's express consent has been obtained.
(d) DPP4: Implement adequate security measures to safeguard the personal data.
(e) DPP5: Publicly disclose their privacy policies and practices, including the types of personal data they hold.
(f) DPP6: Data subjects are entitled to request access to and correction of their personal data.
A breach of the DPPs may lead to the PCPD conducting an investigation and serving an enforcement notice on the data user requiring remedial measures to be taken. Non-compliance with an enforcement notice is an offence attracting a fine of HK$50,000 and two years imprisonment, with a daily fine of HK$1,000 for a continuing offence, for a first conviction. Higher penalties apply for repeat convictions. Where an enforcement notice had previously been issued and complied with, but the data user commits the same contravening acts again, this will give rise to an offence (without the need for a new enforcement notice to be issued).
Exemptions to DPPs
The PDPO contains exemptions for certain DPPs, including:
(a) an exemption for personal data held for domestic or recreational purposes from DPPs 4 and 5;
(b) exemptions to data access and correction obligations (DPP6) for certain employment-related personal data or on the grounds of legal professional privilege; and
(c) exemptions from data use limitations (DPP3) and data access and correction requests (DPP6) for, inter alia, crime prevention or detection, news activities, and protecting the data subject's health.
If an enforcement notice is breached, it is a defence to show that the data user exercised all due diligence to comply with the notice.
Direct marketing
The PDPO imposes stringent obligations regarding direct marketing. Data users must obtain the data subjects' express consent (which can include an "indication of no objection", but not silence or no response) before using or transferring their personal data for direct marketing. To obtain their valid consent, data users must notify the data subjects of certain information beforehand, including the categories of goods or services to be marketed to them and the classes of recipients. When a data subject's personal data is used for direct marketing for the first time, the data user must notify the data subject of her right to opt-out. Data users must abide by the data subject's withdrawal of consent.
Violating the direct marketing provisions is an offence attracting a maximum fine of HK$500,000 and three years imprisonment, or a fine of HK$1,000,000 and five years imprisonment for transferring the data for gain. It is a defence to establish that the data user took all reasonable precautions to prevent the commission of the offence.
Disclosing data without data user's consent
It is an offence to disclose personal data obtained from another data user without that data user's consent, with the intent to obtain gain or cause a loss to the data subject. Offenders are liable to a HK$1,000,000 fine and five years imprisonment.
The PDPO was recently amended by the Personal Data (Privacy) (Amendment) Bill 2021which was passed on 29 September 2021. The PDPO amendment was introduced to combat doxxing so , it is now an offence to disclose any personal data of a data subject without the relevant consent of the data subject: (i) with the intent to cause any specified harm to the data subject or any family member of the data subject; or (ii) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. Offenders are liable to a fine of up to HK$100,000 and two years' imprisonment (if there is no proof of any actual harm caused), or a fine of up to HK$1,000,000 and five years' imprisonment (if there is proof of actual harm caused). The term "specified harm" is broadly defined and includes bodily harm, psychological harm, property damage and various forms of harassment.
Offenders may rely on certain defences, including reasonably believing that the disclosure was necessary for crime prevention or detection.
Other offences
Anyone who receives personal data for the purposes of a business transaction, due diligence process, can only use that data for such purpose and must return or destroy it (after completing the due diligence). Breaching this obligation attracts a fine of HK$50,000 and two years' imprisonment.
Other breaches of the PDPO (except regarding the DPPs or direct marketing restrictions) amount to an offence, attracting a HK$10,000 fine. Some may additionally result in six months imprisonment (e.g. providing false or misleading information to the PCPD).
Civil proceedings
Data subjects may claim compensation from data users, including injury to feelings, for breach of the PDPO.
Limitation period
A complaint must be filed with the PCPD within two years of the date the complainant gained actual knowledge of the wrongful conduct, and individuals can initiate civil proceedings within six years of the date the wrongful act occurred.
Jury
There is no trial by jury.
Recent developments
Previously, the PCPD mainly focused on enforcing the direct marketing restrictions. Recently, he has been concerned with curbing doxxing activities (i.e. unauthorized disclosure of personal data for harassment purposes). The Personal Data (Privacy) (Amendment) Bill 2021 introduced Hong Kong. amendments which effectively widen the scope of doxxing related offences to cases where there is no proof of actual harm and expand the scope of the types of "harm" covered. In addition, the PCPD has also been granted enhanced powers of enforcement to counter doxxing activities, such as the power to issue "cessation notices" as well as increased investigation and enforcement powers.
Originally Published by International Media Law Guide.
Visit us at mayerbrown.com
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2020. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
