*************************
Following is a question by the Hon Emily Lau and a written reply by the Secretary for Education and Manpower, Professor Arthur K C Li (in the absence of Secretary for Home Affairs) at the Legislative Council meeting today (May 2):
Question:
On March 14 this year, the Privacy Commissioner for Personal Data published an investigation report on the alleged disclosure, by a local e-mail service provider, of the personal data (including the Internet Protocol (IP) address) of one of its account subscribers to mainland law enforcement agencies. The investigation found that the service provider had not contravened the Personal Data (Privacy) Ordinance (the Ordinance). In this connection, will the Executive Authorities inform this Council:
(a) given that it may be possible to ascertain the identity of an individual when an IP address is combined with the identifying particulars of the individual, whether the Government will consider including IP addresses and other identifying particulars of individuals in the scope of protection under the Ordinance; if not, of the reasons for that;
(b) whether the Ordinance applies when none of the acts of collection, holding, processing and use of the personal data takes place in Hong Kong; and
(c) whether they will consider amending the Ordinance to enhance privacy protection?
Reply:
Madam President,
(a) "Personal data" is defined in Section 2(1) of the Personal Data (Privacy) Ordinance (PDPO) to mean any data which satisfy the following three criteria :
(i) relating directly or indirectly to a living individual;
(ii) from which it is practicable for the identity of the individual to be directly or indirectly ascertained; and
(iii) in a form in which access to or processing of the data is practicable.
An IP address when combined with other identifying particulars relating to a living individual may be regarded as personal data for the purpose of the Ordinance. Whether an IP address together with any identifying data constitute "personal data" under the PDPO will depend on the specific circumstances surrounding the case.
(b) The PDPO regulates an act or practice undertaken by a data user and the term "data user" is defined in Section 2 of the Ordinance to mean "a person who either alone, or jointly or in common with other persons, controls the collection, holding, processing or use of the data". The applicability of the PDPO in a particular case would depend on whether an alleged data user has control, in or from Hong Kong, over the collection, holding, processing or use of the personal data.
(c) The Commissioner is undertaking a comprehensive review of the PDPO and will examine, among others, whether the existing provisions of the Ordinance still afford adequate protection to personal data having regard to developments, including advancement in technology, in the last decade. The Administration will consider the Commissioner's proposals when available.
Ends/Wednesday, May 2, 2007
Issued at HKT 12:01
NNNN
