Background

A complaint was lodged with the Office of Privacy Commissioner for Personal Data (“Commissioner”) against a foreign domestic helper recruitment agency, alleging that the agency had transferred his personal data to a third party without his consent.

When investigating the complaint, the Privacy Commissioner first requested the responsible person of the employment agency to provide relevant information required for the investigation. Upon failing to obtain a reply, the Privacy Commissioner then issued a summons to the sole director of the agency under section 44(1) of the Personal Data (Privacy) Ordinance (“PDPO”) to attend the Privacy Commissioner’s office on a specific date.

Pursuant to section 44(1) of PDPO, the Privacy Commissioner may summon before him any person who is the complainant or is able to give relevant information, examine such person and require such person to produce document or information. Although he was served with such summons, the director of the employment agency, without any lawful excuse, did not attend the Privacy Commissioner’s office.

Criminal offence

The Privacy Commissioner referred the case to the Police for criminal investigation. The director was later prosecuted and charged under section 50B(1)(b) of  PDPO for failing to comply with the lawful requirement of the Privacy Commissioner without lawful excuse. According to section 50B of PDPO, a person commits an offence if he, among others, fails to comply with lawful requirement of the Privacy Commissioner. He shall also be liable upon conviction to a fine of up to HK$10,000 and to imprisonment for six months.

The case was heard at the Kowloon City Magistrates’ Court in June 2017. The director pleaded guilty to the charge and was fined HK$3,000. This is the first ever conviction of the offence of failing to comply with a lawful requirement of the Privacy Commissioner under section 50B(1)(b) since the PDPO came into effect in December 1996.

Takeaway

This unprecedented case where failure to co-operate in a privacy investigation turns into a criminal prosecution serves as an important reminder to us all that requests of the Privacy Commissioner should be treated seriously and dealt with in a timely manner. Companies and institutions should also ensure that there are practical steps in place to safeguard personal information of employees and job-seekers and that their data should not be transferred to unrelated parties.