Case Summary and Outcome

In 2020, the Hong Kong Administrative Appeals Board determined that the territorial boundary of the Personal Data (Privacy) Ordinance extended only to data users who have operations controlled in/ from Hong Kong. The Board rejected an Appeal where an individual sought Google LCC to delist links from its search engine results as they led to the news pertaining to his arrest for participation in a protest, thereby infringing his right to be forgotten. While the Ordinance dealt with a specific area of trans-border transfer of data, it did not make any inference to widen its applicability to persons outside of Hong Kong. By application of “the sole and proper” test, the Board held that Google LLC did not qualify as a data user under the Ordinance as no part of the data cycle (i.e., collection, holding, processing, and use) was based out of Hong Kong. Further, the Appellant had failed to point out substantive and convincing materials both within and outside of the Ordinance to support the extra-territorial applicability of the Ordinance. The Board concluded that there was no independent right to be forgotten under applicable laws of Hong Kong.

---

Facts

On July 2, 2014, the Hong Kong Police arrested several protestors, including the Appellant (X), for participating in an unauthorized assembly. As stated by a police report, “the arrested persons refused to leave after the protest, occupied vehicular roads and blocked the traffic, thereby endangering public safety and order” [para.2]. The incident and the names along with post-titles of the arrested persons were widely reported in news and articles.

According to the Appellant, various online forums had disseminated a list of the arrested protestors. Likewise, he claimed that when he searched his name on Google, the results displayed links to publications referencing his detention.

On October 19, 2017, the Appellant requested Google LLC to delist the links from the search engine as “the contents of the links were defamatory, false, unsupported by sufficient evidence” [para. 5]. However, on November 1, 2017, Google LLC informed the Appellant that “they had decided not to action on the links and encouraged him to resolve any disputes directly with the website owners and individuals who posted the contents” [para.6]. As a result, on May 24, 2018, the Appellant lodged a complaint against Google LLC with the Privacy Commissioner for Personal Data (Respondent).

After a thorough examination of the case, on June 19, 2019, the Respondent informed the Appellant of its decision to “terminate the investigation under section 39(2)(d) of the Personal Data (Privacy) Ordinance ( Ordinance), and in accordance with paragraph 8(e) of their Complaint Handling Policy” [para. 9].

The Respondent based its decision on four grounds: Firstly, it considered that the complaint could not be pursued since Google LLC was outside the territorial jurisdiction of the Ordinance.Secondly, there was a lack of evidence to prove that the contents of the links sought to be removed were inaccurate. As per the Respondent, Appellant had failed to provide the necessary justification to demonstrate that there was a prima facie case of infringement of the Ordinance.  Thirdly, the Respondent considered that right to be forgotten was not applicable to the present case and that non-erasure of the data posted through the links could be reasonably justified. The Respondent held that the Ordinance imposed an obligation on data users to erase personal data. Further, Data Protection Principle 2(2) (DPP 2(2)) provides that all data users must take all practicable steps to ensure personal data is not kept longer than is necessary to fulfill the purpose for which it is /or is to be used” [para.13]. Despite the above observation, the Respondent held that in the present case, the incident pertaining to the Appellant, content in relation to which was uploaded on the interent, resulted in public concern and thus, the information posted through the links were published for journalistic purposes. Therefore, there was no unlawful interest in displaying the links.

Additionally, the Respondent stated that while they understood the Appellant’s view that the right to be forgotten (RTBF) should be established in Hong Kong, the Ordinance did not explicitly provide an individual with such a right. Notwithstanding this, the Respondent opined that RTBF under Article 17 of the General Data Protection Regulation (GDPR) gives an individual a right to seek organizations / businesses to delete the personal data without undue delay under specified circumstances, including where the personal data is no longer necessary in relation to the purposes for which it is collected. [para.22]. As per the Respondent, while the purpose of RTBF was to empower individuals to have control over their data, it did not allow such individuals to erase past events, indiscriminately. Further, the Respondent held that RTBF was not meant to take precedence over freedom of expression and information, albeit the continued existence and dissemination of the information concerned may be prejudicial to the data subject. While assessing a delisting request, fair balance must be maintained between the legitimate interest of internet users who are potentially interested in accessing the information and the data subject’s fundamental right to privacy and data protection.

By referring to NT1 & NT2 v. Google LLC [2018] EWHC 99 (QB), Respondent held that in the present case, RTBF was not applicable as the information pertaining to Appellant’s arrest which was published through the links, could have been sensitive however, the same was not of private nature. Further, the fact that press had widely reported the issue, it was a foreseeable consequence of the Appellant’s actions. The content also did not constitute hate speech nor libel. Additionally, there was no evidence demonstrating that the content was inaccurate, irrelevant, or excessive; and the matters reported attracted public concern, forming basis for several discussions in the society.

The Respondent considered that the Appellant’s reputation was outside the scope of its attributions. The Respondent relied upon the Administrative Appeal Board’s decision in Administrative Appeal No. 49/2005 to highlight that false information and fabricated evidence did not fall under the definition of personal data and therefore, was not protected by the Ordinance.

Finally, the Respondent was not in a position to comment on whether the links to the publications were defamatory or whether Google LLC was a publisher of such allegedly defamatory materials available on its search engine. As per the Respondent, assuming that Google LLC had published defamatory information about the Appellant, the matter could be resolved through legal channels rather than resorting to personal data protection.

On July 2, 2019, the Appellant lodged an appeal against the Respondent’s decision with the Administrative Appeals Board (the Board) and also filed an application for an anonymity order.

On September 11, 2019, the Respondent filed a statement, followed by Google LLC filing its written submissions on on October 3, 2019. Appellant also filed a statement of response counter the Respondent’s statement and the written submissions of Google LLC.

 

---

Decision Overview

In the present case, the main issue for analysis before the Administrative Appeals Board was whether the territorial scope of the Personal Data (Privacy) Ordinance applied to Google LLC and, if so, whether the search engine could be held responsible for not deleting the information as requested by the Appellant.

The Board started by examining the Appellant’s request for anonymity. As a general rule, the Board stated that all its hearings were to be public as per Section 17 of the Administrative Appeals Board Ordinance (Cap. 442). However, the precept also established it could make an exception if, after consulting with the parties, it considered desirable to prohibit or restrict the publication or disclosure to some or all parties to the appeal. The Board then held that any restriction on open administration of justice must balance all pertinent rights and freedoms, such as the principle of open justice from a litigant’s perspective and the public’s point of view. Further, the Board stated that past precedents, very often, required the necessity to justify a restriction on open justice.

According to the Board, the requested anonymity concerned the Appellant’s name and particulars; therefore, disclosing such information opposed what the Appellant pursued in his claim.  The Board held that “it will be an irony and will frustrate the said legitimate purpose of the Appellant if in course of this appeal, the hearing of which, is open to the public and the Decision in relation to which is also to be published, if the information which the Appellant seeks to protect were to be made public” [para. 23, B. 3 Analysis].

Also, the Board noted that the issues presented in the appeal were matters of legal nature that did not relate to the Appellant’s identity. Consequently, the Board held that neither the public, the Respondent nor Google LLC had any interest concerning the Appellant’s identity. Accordingly, it allowed the Appellant’s request for anonymity.

The Board then examined seven key issues to respond to the parties’ concerns raised in the appeal. They have been elucidated as under:

What is the territorial scope/jurisdiction of the Ordinance

The Respondent and Google LLC submitted that the territorial scope of the Ordinance only covered personal data in relation to which control is placed in Hong Kong. Contrary to this, Appellant claimed that the Ordinance had an extra-territorial effect and the Respondent had “powers to enforce the Ordinance  in relation to all data, including instances where the controller was based outside of Hong Kong, while the Respondent was situated and controlled the use of data in Hong Kong. Appellant claimed that the purpose of the Ordinance, as set out in Chapter 17 of the report of the Law Reform Commission (LRC) on Reform of the Law Relating to the Protection of Personal Data published in 1994 (LRC Report), which was validated by section 33 of the Ordinance, gave the extra-territorial nature to the Ordinance.

The Board established that the wordings used in Chapter 17 of the LRC Report and Section 33 of the Ordinance were not identical. While Chapter 17 provides for “processing of personal data in Hong Kong”, Section 33(l)(a) provides for “personal data, the collection, holding, processing or use of which takes place in Hong Kong ” [para. 56]. Additionally, the Board held that the contexts of chapter 17 of the LRC Report and Section 33 of the Ordinance were different,” since Section 33 deals with the specific transfer of specific data out of Hong Kong, and not general matters of use or control of any data in Hong Kong” [para. 57]. In contrast to this, Section 33 references persons outside Hong Kong. Thus, the Appellant’s reference to the said provisions did not render any assistance to support the argument of extra-territorial effect of the Ordinance.

The Board considered that the scope and provisions of section 33 of the Ordinance dealt with a specific area of trans-border transfer of data, which did not suggest any intention of the legislature to widen the applicability of the Ordinance to persons outside of Hong Kong.

Moreover, the Board held that the Appellant had relied on three cases that were decided in a completely different context and were irrelevant to the present case. In the Board’s view, the Appellant had failed to point out substantive and convincing materials both within and outside of the Ordinance to support his claim of the extra-territorial nature of the Ordinance.

Further, the Board upheld the general principle that local legislation had no extra-territorial effect unless vital leads to the contrary were strong. Accordingly, the Board determined that there was nothing to suggest that the Ordinance would apply to persons outside of Hong Kong in the context of data protection. The Board ultimately concluded that the scope/territorial jurisdiction of the Ordinance only covers persons i.e., data users who have operations controlled in or from Hong Kong.

Whether the Application of the Ordinance was based on the “control requirement” and “processing requirement”

The Appellant submitted that the control as well as the processing requirement were sufficient requirements under the Ordinance, such that if Google LLC operations satisfied either of the two requirements which take place in Hong Kong, Google LLC would be considered to have maintained operations within Hong Kong to be brought under the scope and applicability of the Ordinance.

In contrast, the Respondent maintained that the control requirement is the sole test. Contrary to this, Google LLC submitted that both requirements form the necessary prerequisites so that both have to be operated in Hong Kong.

The Board held that the Appellant’s interpretation of a processing requirement meant that there was a real and substantial processing of data which covers the collection, holding, processing and use in Hong Kong, thus, applying a broader meaning to the word processing. The Board maintained that, for the jurisdiction of the Ordinance to apply, the sole and proper test was to consider whether the data user controls all or any part of the data cycle (i.e., collection, holding, processing, and use) in or from, Hong Kong.

Whether Google LLC lies Outside of the Territorial Jurisdiction of the Ordinance

According to the Board, it was evident that Google LLC and not Google HK operated the Google search engine. Google LLC did not have any establishments or offices in Hong Kong. The Board acknowledged that even though search results were available on the Google HK website, it was not a significant factor since the data centers in Asia were located in Singapore and Taiwan. Similarly, the Board recognized that the search engine that conducted the processing of browser search commands was situated outside Hong Kong.

According to the Board, the jurisdiction and power of the Respondent were limited and did not extend to regulate and control the conduct of a foreign body such as Google LLC, whose operations were not controlled within or from Hong Kong; hence, the search engine did not fall within the scope of “data user” under the Ordinance.

The Board held that such conclusions and findings were sufficient to dispose of and dismiss the appeal.

Whether there was Collection of Data in Hong Kong

The Board found that there was no collection of data in Hong Kong since all the operations of Google LLC took place outside of Hong Kong and that the collection of data on the website through the internet was not required to be done physically in Hong Kong.

Whether there was processing or Holding of Data in Hong Kong

In light of the observations on the previous issue, the Board considered that there was no processing or holding of data in Hong Kong.

Whether Google LLC was a user of data

The Board held that even though Google LLC did not fall under the territorial scope of the Ordinance, it fell within the definition of data user under section 2(1) of the Ordinance. As per this provision, “Google LLC uses the data collected which can identify the subjects for display in its search engine definition” [para. 84]. Thus, the Board considered that if not for the Ordinance which added the jurisdictional impediment; Google LLC would have qualified as a data user under the Ordinance.

Whether Google LLC acted in breach of DPP 2(2) or Section 26 (1) of the Ordinance

As the Board had resolved the issue pertaining to the extra-territorial effect of the Ordinance, it considered that it was not strictly necessary to express any views on “whether Google LLC acted in contravention of DPP or in breach of section 26 (1) of the Ordinance for failing to erase the personal data of the Appellant from the search engine upon his request” [para. 85].  Nonetheless, the Board briefly addressed the legal issues in relation to RTBF and the criteria set out in the UK case of NT1 & NT2 v. Google LLC [2019] QB 344 (NT1 & NT2 Case).

The Board held that while RTBF is not an independent right, it is not irrelevant since the Ordinance provides that data should be erased under the DDP2(2) and Section 26(1) of the Ordinance on the grounds of data inaccuracy, or where the data should not be kept longer than necessary.

Further, the Board summarized the findings and criteria established in the Court of Justice of the European Union (CJEU) case of Google Spain SL, Google Inc. v Agencia Española de Protección de Datos (AEPD), Mario Costeja Gonzalez (C-131/12, 13 May 2014) and the United Kingdom case of NT1 & NT2 Case. Consequently, the Board held that the factors set out in such cases could be considered appropriate when assessing data erasure principles.

Finally, the Board dismissed the Appellant’s appeal. Additionally,  given that both the Respondent and Google LLC indicated that they would not seek costs against the Appellant, no orders were made as to costs of the appeal.

---