The Personal Data Privacy Ordinance and Its Language

The Personal Data (Privacy) Ordinance and Its Language Presented by Roderick B Woo 12 October 2013 All copyrights reserved 1

He who is not acquainted with foreign languages knows nothing of his own. ” “ Gothe, Maximen und Reflexionen 2

Hong Kong’s Official Languages 基本法第九條 : 香港特別行政區的行政機關、立法機關和司法機 關，除使用中文外， 還可使用英文， 英文也是 正式語文 Article 9 of the Basic Law : In addition to the Chinese language, English may also be used as an official language by the executive authorities, legislature and judiciary of the Hong Kong Special Administrative Region 3

Chinese language ß ß The most used language in the world because of China’s vast population No noticeable increase in number of words (i. e. characters) for a long time Rich vocabulary to describe emotions, human relationships and livelihood related matters Less words (than English) to enable fine distinctions to be made in technical and legal spheres 5

English language英語 Second comes the English which is the world’s most popular language A language of convenience, especially in science, communication, business, trade and politics A living language that continues to grow – countless new words are born every year 80% existing vocabulary are derived from other languages, mostly Germanic, Latin, Greek, French, Dutch and Scandinavia. 7

近年英語的認同 Yes, No, OK, TV, CD, VCD, DVD, Pizza, DNA, CD-ROM, Show, Sales, Spare, Cool, E-mail, Blog, Daddy, Mommy, Baby, Out, Log In, Log out, Hello, Tango, IQ, IT, OL, Whats. App, 卡拉OK, Disco, Pass, AIDS, SARS etc. 8

條例旨在保障個人資料(的私隱) ß ß ß 個人資料 : personal data (of) 屬在世人士的 : a living individual (contained) 資料存在的形式 : in a form in which access to and processing of the data is practicable 條例並無明言是保障個人私隱 Ordinance does not purport to protect privacy 11

《個人資料(私隱) 條例》 載 有 70 項條文及6 附表 70 sections and 6 schedules. There is a Long Title (詳題) but no Object provision Originally “data” was treated as plural and always followed by “are” or “have. ” In the Amendment Ordinance 2012, “data” is always singular and followed by “is” and “has” 12

Data (資 料 ) vs Information (資 訊) Information is the interpretation observer applies to the data. that an Data becomes information only when it is communicated, received and understood. Where data consists of acts or signs which require any meaning, they remain in that state of pre-information until they are understood by another. 13

資料使用者 vs 資料當事人 Data user vs data subject Data user is he who controls the collection, holding, processing or use of personal data Data subject is the living individual who is the subject of the personal data 14

保障資料六原則 Six DPPs ß ß 6 data protection principles (DPPs) form the basis of the personal data law All data users must abide by these DPPs although a contravention of such principles does not of itself constitute an offence, but non-compliance of an enforcement notice (執行通知) which follows a contravention is an offence 15

Regulatory Role of Privacy Commissioner for Personal Data (“PCPD”) 個人資料私隱專員的規管角色 He determines whethere is a breach of any DPP. He is not tasked to investigate any offence under the Ordinance. The job belongs to the Police. 26

Legal language “Like most judges and lawyers, I spend my life puzzling over the meaning of words. The words may exist in a national or sub-national constitution. They may appear in local legislation. Or they may emerge from judicial reasons, written over the centuries, in the exposition of the common law. ” The Hon Justice Michael Kirby (Australia) 28

法例的語文的應用 ß v 香港法例第 1章 : 《 釋 義 及 通 則 條 例 》 第 5 條: 「在任何條例中凡對任何字或詞句下 有定義，該定義的適用範圍即擴及該字或詞 句的文法變體及同語族詞。」 Where any word or expression is defined in any Ordinance, such definition shall extend to the grammatical variations and cognate expressions of such word or expression. 29

《 釋 義 及 通 則 條 例 》(1) v v 第 9 條 : 條例英文本內的中文字和詞句，按 中國語文和風俗解釋，而條例中文本內的英 文字和詞句，則按英國語文和風俗解釋。 Chinese words and expressions in the English text of an Ordinance shall be construed according to Chinese language and custom and English words and expressions in the Chinese text of an Ordinance shall be construed according to English language and custom. 30

《 釋 義 及 通 則 條 例 》(3) (1) The English language text and the Chinese language text of an Ordinance shall be equally authentic, and the Ordinance shall be construed accordingly. (2) The provisions of an Ordinance are presumed to have the same meaning in each authentic text. (3) Where a comparison of the authentic texts of an Ordinance discloses a difference of meaning which the rules of statutory interpretation ordinarily applicable do not resolve, the meaning which best reconciles the texts, having regard to the object and purposes of the Ordinance, shall be adopted. 32

《 釋 義 及 通 則 條 例 》(4) 第 19 條 : 條例必須當作有補缺去弊的作用，按其真正用 意、涵義及精神，並為了最能確保達致其目的而作出公正、 廣泛及靈活的釋疑及釋義。 An Ordinance shall be deemed to be remedial and shall receive such fair, large and liberal construction and interpretation as will best ensure the attainment of the object of the Ordinance according to its true intent, meaning and spirit. 33

S. 28(4) plain and clear ? “(4) Where pursuant to section 19(3)(c)(iv) or (4)(ii)(B)(II) a data user may comply with a data access request by supplying a copy of the personal data to which the request relates in one of 2 or more forms, the data user shall not, and irrespective of the form in which the data user complies with the request, impose a fee for complying with the request which is higher than the lowest fee the data user imposes for complying with the request in any of those forms. ” 36

S. 20(2) plain and clear? “(2) Subsection (1)(b) shall not operate – subsection to personal data of which any other individual is the data subject includes a reference to information identifying that individual as the source of the personal data to which the data access request concerned relates unless that information names or otherwise explicitly identifies that individual; ” 37

S. 64(10) original version “(10) A data user who, without reasonable excuse, contravenes any requirement under this Ordinance (other than a contravention of a data protection principle) for which no other penalty is specified in this section commits an offence and is liable on conviction to a fine at level 3. ” >>>>>>> 38

S. 64 A (Effective 1 Oct 2012) S. 64 A : “(1) A data user who, without reasonable excuse, contravenes any requirement under this Ordinance commits an offence and is liable on conviction to a fine at level 3. (2) Subsection (1) does not apply in relation to (a) a contravention of a data protection principle; ” 39

Why not call a spade? Both the original and the revised versions of the afore-mentioned provisions come to mean the same thing – a mere contravention of the data protection principles is not an offence Why does the Ordinance not say that plainly and directly ? 40

Legislative drafting In choosing the proper legislative language, it is desirable to determine the readership. Should the law be written for : (a) the people ? or (b) the legal professionals who interprets for the people ? 41

The case for the people The law applies to people and their conduct Ignorance of the law is no excuse. Put another way, everyone is expected to know the law, and can read the law Lawyers should not be needed in the general understanding of the law 42

The case for the professionals The law is and has to be a specialist subject and requires a special language. Lawyers are trained to use that language while lay people are not Any language improvement should aim at making it easier for lawyers to use but not necessarily for lay people to understand 43

The middle ground A statue should aim to address several audiences. It should aim to achieve maximum certainty. In all cases, general principles should be clear to lay people while skilled professionals can assist them in more complex issues 44

Falling between two stools What if the legal language is not only unclear to lay people, but also unclear to professionals? Time wasted interpretation in getting authoritative Costs to the public and the litigants 45

“shall” and “may” Two of the most often used words in the Personal Data (Privacy) Ordinance Not defined there nor in other ordinances Capable of many meanings and a favourite point of argument in many disputes inside and outside of a courtroom Should they not be replaced by other words wherever practicable? 46

The use of “shall” For a long time, “shall” has been used to : (a) (b) (c) (d) (e) impose a duty – a data user shall do such… prohibit conduct – no person shall do such… create conditions precedent – to achieve xxx, a person shall do such… make a declaration – the data user shall be deemed…. denote future tense Most modern jurists suggest that the word should not be a part of the legal language due to its myriad and ambiguous meanings. 47

What does “shall” mean? (1) S. 33(1) : This section shall not apply to personal data … S. 33(2) : A data user shall not transfer personal data … S. 33(4) : Where the Commissioner has reasonable grounds … he shall cause that place to cease to be specified … 48

What does “shall” mean? (2) S. 47(1) : where the Commissioner has completed an investigation, he shall inform the relevant data user S. 66(1)(c) : an individual who suffers damage shall be entitled to compensation S. 68 : A notice shall be deemed to be so served 49

Modern avoidance of “shall” (1) Deuteronomy, Chapter 5 17. Thou shall not kill. 18. Neither shall thou commit adultery. 19. Neither shall thou bear false witness against thy neighbour Bible - Authorised King James Version 50

Modern avoidance of “shall” (2) Deuteronomy, Chapter 5: 17. You must not kill. 18. You must not commit adultery. 19. You must not steal. The New Jerusalem Bible (most used Roman Catholic Bible outside of USA) 51

Modern avoidance of “shall” (3) Corinthians I, Chapter 14: 11 Therefore if I know not the meaning of the voice, I shall be unto him that speaketh a barbarian, and he that speaketh shall be a barbarian unto me. Bible – Authorised King James Version 52

Modern avoidance of “shall” (4) Corinthians I, Chapter 14: 11 If then I do not grasp the meaning of what someone is saying, I am a foreigner to the speaker, and the speaker is a foreigner to me New English Translation, NET Bible 53

Amendments to the PDPO The Ordinance was first enacted in 1995. Substantial amendments were made by Personal Data (Privacy) (Amendment) Ordinance 2012 There is a Note in the Amendment that “The format of the whole Ordinance has been updated to the current legislative styles. ” This is not entirely true. 54

Section 64(8) : original version “(8) It shall be a defence for a relevant data user charged with an offence under subsection (7) to show that the data user exercised all due diligence to comply the enforcement notice concerned. ” 55

S. 50 A(2) (effective 1 Oct 2012) “(2) In any proceedings for an offence under subsection (1), it is a defence for the data user charged to show that the data user exercised all due diligence to comply with the enforcement notice. ” 56

Ss. 35 B – 35 M on direct marketing (effective 1 Apr 2013) In these sections, “must” and “must not” have made their first appearance and replaced “shall” and “shall not” Examples : 35 C (2) The data user must … (a) inform the data subject … 35 E (1) A data user …. must not use … 35 F (1) A data user must … 57

Inconsistencies in the revised Ordinance Examples DPP 4(1) All practicable steps shall be taken to ensure that personal data …. . are protected. DPP 2(2) All practicable steps must be taken to ensure that personal data is not kept longer than is necessary…. However instances like DPP 5, the same treatment should have been adopted, e. g. “All practicable steps shall be taken to ensure…” be changed to “All practicable steps must be taken…. ” 58

Inconsistencies in the revised Ordinance The Amendment produces two styles of writing S. 50 A(2) (effective Oct 2012) adopts the new term “it is a defence …”. Whereas the new s. 65(3) (effective April 2013) continues with the old term “it shall be a defence”, viz. “In proceedings brought under this Ordinance against any person in respect of an act or practice alleged to have been done or engaged in, as the case may be, by an employee of his it shall be a defence for that person to prove that he took such steps as were practicable to prevent the employee from 59 doing that act……. ”

The replacement words: “must” and “must not” For obvious reasons, it is undesirable for “must” “must not” and “shall” “shall not” to be used alternately in the same Ordinance if they are intended to carry the same meaning 60

The use of “may” in PDPO (1) One of the most used words apart from “shall” in the Ordinance Example: Section 7 (2) A person appointed to act as the Commissioner (a) shall perform the functions; and (b) may exercise the powers of the Commissioner under the Ordinance 61

The use of “may” in PDPO (2) Heading of section 20 Circumstances in which data user shall or may refuse to comply with data access request 62

Multiple functions of “may” (a) (b) (c) (d) (e) to confer an authority : a data user may … to confer a right : a data user may claim certain privileges to impose conditions on the exercise of the authority or right to impose procedural limitations : data user may do something provided such procedures are followed to denote a future tense 63

A case for change In legislative drafting, there is a strong case for the over-worked “may” to be replaced by more suitable words to serve different purposes. Ambiguity and unnecessary arguments could be avoided. Clarity must be the paramount objective 64

Resistance to change Words and phrases have been defined by successive courts Old and worn words and phrases are convenient to use by lawyers Courts have got accustomed to well established words Vested interest of the legal profession 65

You 謝謝 Thank 66