Privacy in Hong Kong: overview
A Q&A guide to data protection in Hong Kong.
This Q&A guide gives a high-level overview of data protection rules and principles, including obligations on the data controller and the consent of data subjects; rights to access personal data or object to its collection; and security requirements. It also covers cookies and spam; data processing by third parties; and the international transfer of data. This article also details the national regulator; its enforcement powers; and sanctions and remedies.
To compare answers across multiple jurisdictions, visit the Privacy Country Q&A tool.
This article is part of the global guide to data protection. For a full list of contents, please visit www.practicallaw.com/dataprotection-guide.
The right to privacy and freedom of expression in Hong Kong is enshrined in the Basic Law of the Hong Kong Special Administrative Region of the People's Republic of China (Basic Law).
The Basic Law serves as Hong Kong's constitutional framework and sets out the basic policies of the People's Republic of China towards the Hong Kong Special Administrative Region. Chapter III of the Basic Law sets out the fundamental rights and duties of Hong Kong residents, including the right to privacy and the right to freedom of expression.
The laws of Hong Kong (including common law and legislation) must not contravene the Basic Law.
Bill of Rights
The Bill of Rights Ordinance (Cap. 383 of the Laws of Hong Kong) (Bill of Rights) adopts the International Convention on Civil and Political Rights (ICCPR) into Hong Kong law. The Bill of Rights contains provisions equivalent to those of the ICCPR that protect the right to privacy and the right to freedom of opinion and expression.
The Personal Data (Privacy) Ordinance (Cap.486 of the Laws of Hong Kong) sets out detailed regulations in relation to the privacy of personal data.
The Interception of Communications and Surveillance Ordinance (Cap. 589 of the Laws of Hong Kong) regulates covert surveillance activities by law enforcement authorities in Hong Kong.
Any statute that could potentially limit the right to privacy and freedom of expression, such as the Police Force Ordinance (Cap. 232 of the Laws of Hong Kong) and the Control of Obscene and Indecent Articles Ordinance (Cap. 390 of the Laws of Hong Kong), must be drafted so as not to contravene the Basic Law. The Basic Law also influences the development of areas of the common law that have the potential to affect these rights, such as defamation.
The rights set out in the Basic Law apply to all Hong Kong residents, including both permanent and non-permanent residents.
The Bill of Rights Ordinance (Cap. 383 of the Laws of Hong Kong) (Bill of Rights) applies to the conduct of the Government of the Hong Kong Special Administrative Region and any public authorities.
The fundamental rights and duties of Hong Kong residents provide that (Chapter III of Basic Law):
Hong Kong residents have freedom of speech, of the press and of publication (Article 27).
The homes and any other premises of Hong Kong residents must not be subject to arbitrary or unlawful search or intrusion (Article 29).
The freedom and privacy of communication of Hong Kong residents must be protected by law (Article 30).
The provisions of the International Covenant on Civil and Political Rights as applied to Hong Kong must remain in force and be implemented through the laws of the Hong Kong Special Administrative Region (Article 39).
Bill of Rights
The Bill of Rights Ordinance (Cap. 383 of the Laws of Hong Kong) (Bill of Rights) provide for the following privacy rights:
Nobody will be subject to arbitrary or unlawful interference with his privacy, family, home or correspondence, or subject to unlawful attacks on his honour and reputation (Article 14).
Everybody has the right to hold opinions without interference and the right to freedom of expression, subject to restrictions to respect the rights or reputation of others or for the protection of national security, public order, public health or morality (Article 16).
The Basic Law does not provide for any specific remedies to redress the infringement of privacy rights in Hong Kong.
The Hong Kong courts have authority to interpret any provisions of the Basic Law that are within the limits of the autonomy under the Hong Kong Special Administrative Region (Article 158). Any person can take legal action to challenge a Hong Kong law that is in contravention of the Basic Law. If a court determines that the law is inconsistent with the Basic Law, the relevant part of the law will be declared invalid.
Bill of Rights
Under the Bill of Rights Ordinance (Cap. 383 of the Laws of Hong Kong) (Bill of Rights) any person can commence legal proceedings against the Government of the Hong Kong Special Administrative Region or a public authority that has breached the Bill of Rights. Any court with jurisdiction to hear the proceedings can grant such remedy or make such order (such as an award of damages or the grant of an injunction) in respect of the breach as it has power to grant or make in those proceedings and as it considers appropriate and just in the circumstances.
In Hong Kong, there is no general cause of action for the invasion of privacy. Hong Kong courts have yet to recognise a US-style tort of privacy or to follow English case law led by Campbell v Mirror Group Newspapers Ltd  UKHL 22 which extends the law on breach of confidence to invasion of privacy. In 2004, the Hong Kong Law Reform Commission proposed a statutory tort for invasion of privacy, but this proposal was not adopted.
In some circumstances, a recognised cause of action may protect privacy rights. This includes where:
An invasion of privacy may involve a defamatory publication.
There is trespass onto private property or to the person.
There is a breach of confidence.
There is an actionable nuisance.
However, as these actions are not designed to protect privacy, they will often not apply to conduct that would generally be regarded as an invasion of privacy.
The High Court of Hong Kong recognised a tort of harassment in Lau Tat Wai v Yip Lai Kuen Joey (HCA 1466/2011). The cause of action is available to a claimant who has suffered damage as a result of verbal or physical conduct, directly or through a third party, that is sufficiently repetitive in nature to cause worry, emotional distress or annoyance to another person, where the defendant knew or ought reasonably to have known their conduct would have such an effect.
Nicholas Blackmore, Practice Group Leader, IT & Privacy Law
Professional qualifications Solicitor, High Court of Hong Kong SAR, 2012; Barrister and Solicitor, Supreme Court of Victoria, 2000
Areas of practice. Data privacy; information technology; intellectual property.
Non-professional qualifications. Master of Laws (University of Melbourne); Bachelor of Science (University of Melbourne)
- Advising several major insurance companies on recent amendments to the Ordinance.
- Conducting a privacy compliance audit for a major hotel chain.
- Advising a major consulting firm on the data privacy implications of offshoring their human resources function to mainland China.
- Preparing template privacy policies and statements for use by members of an industry association.
Professional associations/memberships. Law Society of Hong Kong; Law Institute of Victoria; Australian Chamber of Commerce Hong Kong and Macau.