The director of a Hong Kong employment agency was convicted of a criminal offense arising under Hong Kong’s Personal Data (Privacy) Ordinance (“PDPO”) on June 30, 2017. The director pleaded guilty before the Kowloon City Magistrates’ Court to violating section 50B(1)(b) of the PDPO for the offense of failing to comply with a lawful requirement of the Privacy Commissioner. Although other breaches of the PDPO have been prosecuted criminally, including a key 2014 case involving violation of the direct marketing provisions resulting in imposition of the first term of imprisonment under the PDPO, the June 2017 conviction is the first of its kind since the law became effective in 1996 based on the mere lack of responsiveness in an investigation.
Specifically, the case involved the director’s failure to comply with a summons from the Office of the Privacy Commissioner requiringthe director to provide information relating to an investigation and to appear for an examination before the Commissioner. The information sought by the Commissioner related to an investigation of the employment agency after a complaint was filed alleging that the agency transferred personal data without consent.
In connection with that investigation, the employment agency was directed to provide necessary information to the Commissioner. After an apparent lack of response by the employment agency to several requests, the Office of the Privacy Commissioner for Personal Data, Hong Kong, issued a summons to the sole director of the company, mandating the director to appear for an examination and to provide the requested information.
The director failed to appear for the examination and did not offer a lawful excuse. The case was referred to the police, and the director was charged criminally. Following his guilty plea and criminal conviction under section 50B(1)(b), the director was fined personally HK$3,000 (about US$385). Section 50B(1)(b) of the Ordinance provides that a person who, without lawful excuse, fails to comply with any lawful requirement of the Privacy Commissioner commits a criminal offense.
Hong Kong’s Privacy Commissioner, Mr. Stephen Kai-yi Wong, stated: “The conviction serves as a strong deterrent to remind all organisations and individuals to abide by the law and treat personal data privacy seriously. Parties involved in a complaint should fully cooperate with our office and provide all required information for investigation as expeditiously as possible.”
The invocation of the PDPO to sustain a criminal conviction of a corporate director based on conduct of this type serves as a pointed reminder that companies and their agents must work diligently to ensure compliance with lawful requirements and requests of Hong Kong’s Privacy Commissioner. Failure to comply is a criminal offense, and a person convicted under section 50B(1)(b) of the PDPO faces a fine up to HK$10,000 (approximately US$1,300) and imprisonment of up to six months.
As discussed, this and other recent PDPO cases highlight that the stakes are high—corporate directors are potentially subject to personal, criminal responsibility for failures to comply with lawful requests of the Commissioner. The June 2017 case is in line with previous criminal prosecutions that reveal a more aggressive, hardline approach to enforcing the law. The cases also reflect the Privacy Commissioner’s renewed focus on data privacy and security, and demonstrate that timely responding to lawful requests and directives from the Office of the Privacy Commissioner should be of the highest priority.
An official case summary can be found here.
