The Office of the Privacy Commissioner for Personal Data (PCPD) is a Hong Kong statutory body enforcing the Personal Data (Privacy) Ordinance.
Description
The Privacy Commissioner is charged with securing the privacy of individuals. The office is headed by the Privacy Commissioner for Personal Data, Ada Chung.
The office is divided into different functional units: Complaints Division, Criminal Investigation Division, Compliance & Enquiries Division, Legal Division, Global Affairs & Research Division, Corporate Communications Division and Corporate Support Division. It has investigatory and enforcement powers, and publishes best practices and other guidance to organizations and the general public. It is a member of various multinational organizations, including the Global Privacy Assembly (GPA), the APEC Cross-border Privacy Enforcement Arrangement (CPEA) and the Global Privacy Enforcement Network (GPEN).
Function To guarantee the preservation and observance of personal data privacy—the Privacy Commissioner for Personal Data (PCPD) was founded in December 1996 to encourage and enforce adherence to personal data.
The vision of PCPD is to cultivate a society that values and upholds privacy rights regarding personal data. First of all, PCPD aims to raise awareness and educate citizens on personal data privacy via publicity and educational activities. Secondly, PCPD facilitates the lawful and responsible use of personal data by providing suggestions and guidelines. Thirdly, the PCPD uses effective enforcement measures in order to diligently monitor and supervise compliance. Lastly, PCPD reviews and improves continuously to align with global standards for personal data privacy protection.
The PCPD functions based on its core values which include respect for personal data privacy, integrity, embracing technological advancements, and independence. By sticking to its core values, the PCPD provides professionalism and fairness in its actions and decisions.
Therefore, in order to achieve its core values and objectives, the PCPD has developed plans and strategies in different critical areas. The PCPD collaborates with other regulators and data protection offices to manage cross-border privacy concerns and fix complaints efficiently to secure equity and fairness. The PCPD also monitors and supervises compliance, investigating significant privacy risks proactively, and helping organizational data users in meeting their core values.
History The PCPD is an independent statutory body established on 1 August 1996, in response to statutory requirements that ratified its establishment and came into effect on 20 December 1996. The PCPD's predecessor was the "Legal Reform Commission's Privacy Sub-committee". According to the "Privacy Commissioner's Overview 1999-2000", the establishment of the Sub-committee was influenced by the "OECD Privacy Guidelines" in the early 1980s, in which Justice Micheal Kirby provided key principles for handling personal data and was regarded by the first Hong Kong Privacy Commissioner as the "father" of OECD (Organisation for Economic Co-operation and Development) principles for personal data protection.
Beginning in 1989, the Sub-committee undertook a review of Hong Kong laws and made recommendations to protect individuals' privacy from undue interference. This review process culminated in the enactment of the Personal Data (Privacy) Ordinance on 3 August 1995. In early 1996, the sub-committee published a consultation paper proposing measures to address illegal surveillance activities, such as making it an offence to place or use surveillance devices without the consent of the lawful occupier of private premises.Privacy Commissioner Overview Annual Report 2000
In 1997, the discussions surrounding issues like spam calls, pinhole cameras and unauthorized recording contributed to the understanding that personal data could be exposed to the risk of unauthorized or accidental access, processing, erasure, loss, or use. This realization prompted the expansion of the sub-committee's focus to include preventing unfair data collection practices in the business sector, ensuring principles like due collection means and purposes, good accuracy and retention of the data, openness and security of data, data access and correction, and fostering a culture of personal data protection and respect.
As a result, requirements were shortly introduced regarding the purpose and manner of data collection, data retention, data access and correction, disclosure and transfer of personal data, and the appropriate use of such data. The PCPD's role encompasses enforcing these provisions and promoting compliance with the Personal Data (Privacy) Ordinance including but not limited to the collection of data of public entities, in the business sector and in daily life.Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Welcome Message from the Privacy Commissioner for Personal Data. Office for the Privacy Commissioner for Personal Data, Hong Kong. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/commissioner/commissioner.html
Structure The Privacy Commissioner is appointed by the Chief Executive of Hong Kong and is accountable to the Chief Executive. The primary responsibilities of the Commissioner involve overseeing and ensuring adherence to the regulations outlined in the Ordinance. These responsibilities include investigating complaints and providing guidance through the issuance of guidelines and codes of conduct. Similar to the Chief Executive Officer of Securities and Futures Commission(SFC), the Privacy Commissioner is distinct among other statutory bodies, heading a commission that possesses statutory powers of criminal investigation and enforcement, without holding the position of a principal official within the HKSAR government.GovHK. (19 September 2023). GOVHK: Principal officials of the Hong Kong Special Administrative Region . https://www.gov.hk/en/about/govdirectory/po/index.htm
The Deputy Privacy Commissioner for Personal Data is Ms Fanny Wong. The three Assistant Privacy Commissioners are Ms Joyce Lai (Corporate Communication and Compliance), Ms Cecilia Siu (Legal, Global Affairs and Research), and Mr Billy Kwan (Complaints and Criminal Investigation).
Headed by the Privacy Commissioner, PCPD is an independent statutory body with seven functional divisions, namely Complaints Division, Criminal Investigation Division, Compliance & Enquiries Division, Legal Division, Global Affairs & Research Division, Corporate Communications Division and Corporate Support Division.Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Functions/ Responsibilities of PCPD. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/our_organisation/staff/executive_staff.html
Chaired by the Privacy Commissioner, The Personal Data (Privacy) Advisory Committee (PDPAC) was created under section 11 of the Personal Data (Privacy) Ordinance with the purpose of providing guidance and advice to the Privacy Commissioner regarding personal data privacy protection and the functioning of the Ordinance.Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Personal Data (Privacy) Advisory Committee. Retrieved 15 December 2023, from
https://www.pcpd.org.hk/english/about_pcpd/committees/pdac/personal_data_advisory_committee.html It commits to ensure an effective framework for safeguarding personal data privacy in Hong Kong.
Concurrently, the Standing Committee on Technological Developments (SCTD) was established to specifically address the impact of data processing advancements and computer technology on individual privacy concerning personal data. Its primary role is to advise the Commissioner on relevant matters pertaining to the evolving landscape of data processing, and updating the Commissioner's understanding on the importance of protecting individuals' privacy rights in the times of rapid technological advancements.Office of the Privacy Commissioner for Personal Data, Hong Kong. (n.d.). Standing Committee on Technological Developments. Standing Committee on Technological Developments. Retrieved 15 December 2023, from https://www.pcpd.org.hk/english/about_pcpd/committees/sctd/standing_committee_on_technological_developments.html
The PDPAC and SCTD play crucial roles in advising the Privacy Commissioner, enabling the formulation of informed policies and practices that align with the evolving nature of personal data privacy and technological advancements.
List of Privacy Commissioners for Personal Data Stephen Lau Ka-man (1 August 1996 – 31 October 2001) Raymond Tang Yee-Bong (1 November 2001 – 31 July 2005) Roderick Woo Bun (1 August 2005 – 31 July 2010) Allan Chiang Yam-wang (1 August 2010 – 3 August 2015) Stephen Wong Kai-yi (4 August 2015 – 3 September 2020) Ada Chung Lai-ling (since 4 September 2020)
Development
The development of The Office of the Privacy Commissioner for Personal Data (PCPD) in Hong Kong can be traced back to the enactment of the Personal Data (Privacy) Ordinance (PDPO) in 1995, which aimed to regulate the collection, use, and disclosure of personal data by individuals and organisations.
The PDPO was a significant milestone in the development of privacy protection in Hong Kong. It established a legal framework for the protection of personal data and set out the responsibilities of data users and data subjects. However, it lacked an independent regulatory body to oversee and enforce compliance with the ordinance. Recognizing the need for an independent authority to enforce the PDPO, upon the enactment of the Personal Data (Privacy) Ordinance (PDPO), the PCPD was established under section 5(1) of the Ordinance. The PCPD was given the power to investigate complaints, issue enforcement notices, and promote compliance with the PDPO. It operates independently from the government and is accountable to the Privacy Commissioner, who is appointed by the Chief Executive. Over the years, the PCPD has undergone evolutions and developments to keep up with the emerging challenges in the contemporary complex society.
One prominent development would be the amendments to the PDPO. There have been discussions on amending the law to better personal data protection within the territory. The amended ordinance took effect in late 2021, namely the Personal Data (Privacy) (Amendment) Ordinance (PDPAO). The PDPAO differentiated itself from the PDPO by the main feature of criminalising doxxing acts (i.e. to openly expose someone's private personal data such as name, address and occupation). Section 64(3A) of the amended ordinance reads, "A person commits an offence if the person discloses any personal data of a data subject without the consent of the data subject...".
The scope of the PCPD was therefore expanded in the sense that it was empowered to investigate criminal activities including doxxing, as well as the authority to initiate legal proceedings for prosecution for the related offences. In addition, the Privacy Commissioner was also granted the statutory powers to ensure the cessation of sharing doxxing messages. Under the Amendment Ordinance, the PCPD is given new criminal investigation and prosecution powers to handle doxxing cases on a "one-stop" basis from criminal investigation to collection of evidence and prosecution.